Healthcare data breaches expose some of the most sensitive personal information that exists: medical records, Social Security numbers, insurance details, diagnosis and treatment history, and sometimes genetic or mental health information. These exposures can lead to medical identity theft, insurance fraud committed in a patient’s name, and the unwanted disclosure of private health conditions that can affect employment, relationships, or insurability. Hospitals, clinics, health insurers, and healthcare technology vendors are among the most frequently targeted organizations for ransomware and data theft, in part because medical records are especially valuable on illicit markets and healthcare providers often operate complex, interconnected IT systems. A single breach at a hospital system, health plan, or medical billing vendor can affect hundreds of thousands of patients at once. This page tracks confirmed data breaches at hospitals, clinics, insurers, and other healthcare organizations, including what data was exposed, which companies notified the HHS Office for Civil Rights and other regulators, and what affected patients can do next to protect their medical and financial identity.
Nipro Medical Corporation notified Vermont regulators that a data security incident exposed at least one resident’s government-issued identification number, raising identity theft concerns.
Nipro Medical Corporation Data Breach Exposes Government-Issued ID Numbers Read More »
A ransomware group calling itself Genesis claims it breached the network of Consolidated Medical Practices of Memphis, a Tennessee physician group, raising fears that patient and staff records were stolen.
Consolidated Medical Practices of Memphis Data Breach Exposes Patient Health Records Read More »
Vanderbilt University Medical Center notified federal regulators that a hacking incident involving its email systems exposed the personal and health information of 3,298 patients.
Vanderbilt University Medical Center Data Breach Exposes Patient Health Information Read More »
My Doctor, LLC notified the Vermont Attorney General of a data breach that compromised patients’ Social Security numbers, raising serious identity theft risks for those affected.
My Doctor, LLC Data Breach Exposes Social Security Numbers Read More »
Microcode, Inc., a vendor connected to CommonSpirit Health, notified the Washington State Attorney General of a data breach that may have exposed sensitive patient information.
Microcode, Inc. Data Breach Exposes Patient Health and Personal Information Read More »
A federal magistrate judge in Minnesota has approved strict new rules governing how data stolen in the 2024 Change Healthcare cyberattack must be handled during ongoing litigation against UnitedHealth Group.
Change Healthcare Data Breach Exposes Medical Records and Social Security Numbers Read More »
Blue Cross Blue Shield of Minnesota disclosed a hacking incident involving a company network server that affected roughly 3,640 people, though the specific data types exposed have not yet been made public.
Blue Cross Blue Shield of Minnesota Data Breach Exposes Health Plan Member Data Read More »
Minidoka Memorial Hospital confirmed a ransomware attack exposed patient names, Social Security numbers, and medical records, prompting notifications to Idaho regulators and affected patients.
Midtown Community Health Center, Inc. notified the Vermont Attorney General that a data breach compromised patients’ Social Security numbers, raising serious identity theft risks for those affected.
Midtown Community Health Center Data Breach Exposes Social Security Numbers Read More »
Gila Health Resources, LLC notified the Vermont Attorney General of a data breach that exposed Social Security numbers, putting affected individuals at risk of identity theft.
Gila Health Resources Data Breach Exposes Social Security Numbers Read More »