Healthcare Data Breach Lookup & Security Intelligence

Neuro Wellness Spa experienced a data breach on August 24, 2026, when a file containing patient information was inadvertently emailed to another patient. The company became aware of the incident on September 16, 2026, after being informed by the recipient. The exposed information included names, dates and places of service, provider names, exam room or telehealth details, appointment, billing, or service-related notes, chart and claim identification numbers, payment details, procedure codes, and check numbers. Social Security numbers, driver's license numbers, and credit card numbers were not included. The company has contacted the recipient to request deletion of the file and is reviewing its security safeguards and workforce training.

The American Board of Preventive Medicine (ABPM) experienced a cybersecurity incident where an unauthorized actor gained access to their network environment. Following an investigation, it was discovered on or about September 24, 2026, that certain electronic files accessed and/or acquired between March 8, 2026, and March 10, 2026, contained personal information, specifically full names. ABPM is offering complimentary credit monitoring, a $1,000,000 insurance reimbursement policy, and identity theft recovery services to affected individuals.

Blueberry Pediatrics experienced a data security incident due to the exploitation of a vulnerability in Metabase, a technology provider. This vulnerability led to the theft of patient data from Blueberry Medical's Metabase environment. Additionally, Photon, a prescription service provider to Blueberry Medical, also experienced an incident due to the same Metabase vulnerability, exposing a subset of similar information. The compromised data may include names, health plan information, dates of birth, healthcare information, and medication details. Social Security Numbers and payment information were not affected. Blueberry Medical has taken steps to secure its systems and is implementing enhanced security measures.

iRhythm Technologies Inc. experienced a data breach that exposed personal information of its customers. The compromised data includes names, addresses, dates of birth, email addresses, and phone numbers. The exact date of the breach and discovery are not specified, nor is the number of records affected or the attack vector used.

Aesto LLC, a healthcare data migration and archiving service provider for Marana Health Center and Graham County Hospital, experienced a network security incident on or about December 18, 2025. The incident impacted a limited portion of their Amazon Web Services (AWS) infrastructure. An investigation confirmed that between December 2, 2025, and December 18, 2025, a limited amount of sensitive information, including names, pertaining to Covered Entities was potentially accessed or acquired by an unauthorized actor. Aesto has no evidence of misuse and has notified affected Covered Entities. The incident was contained to Aesto's AWS infrastructure and did not affect the systems of the Covered Entities.

On August 28, 2026, Buchalter, LLP, a law firm providing services to Arrowhead Regional Medical Center (ARMC), discovered unauthorized acquisition of its data. An internal investigation, with the help of third-party forensic specialists, determined the incident was isolated and did not impact Buchalter's network. Data mining experts later found that a limited amount of ARMC patient information, including names, was within the affected data set. ARMC was notified on September 4, 2026, and began coordinating notification and mitigation efforts. There is no evidence that the information was viewed or misused. Buchalter and ARMC are offering complimentary identity protection services through Experian.

MedImpact Healthcare Systems, Inc., a pharmacy benefits manager, disclosed a cybersecurity incident on October 18, 2025, where unauthorized activity was identified within certain systems. The company engaged cybersecurity experts to investigate and determined that certain data relating to individuals, including their first and last name and other unspecified data elements, was potentially impacted. MedImpact has taken steps to enhance security safeguards and is offering identity monitoring services through Kroll for a specified period to affected individuals.

Modoc Medical Center experienced unauthorized access to certain files on its network between January 19, 2026, and January 27, 2026. An unknown actor downloaded files containing personal information. The medical center launched an investigation with cybersecurity specialists and a third-party review to determine the scope and contents of the breach. They are notifying affected individuals and offering 12/24 months of credit monitoring and identity restoration services through Experian.

Ridgeway Pharmacy Ltd. experienced a data breach on August 21, 2026, when an unauthorized party accessed their website, which was managed by a third-party vendor. The investigation revealed that personal information such as address, date of birth, health information, insurance information, name, payment card information, and prescription information may have been compromised. The incident did not involve internal systems or sensitive information like Social Security numbers or driver's license numbers. Ridgeway has since remediated the website, enhanced security measures, and is working with third-party vendors to improve security. Affected individuals are being offered 12 months of free credit monitoring and fraud assistance services.

Call-on-Doc, Inc. experienced unauthorized access to its network on December 28, 2025. An investigation determined that protected health information may have been accessed or acquired by an unauthorized party between December 22, 2025, and January 3, 2026. The company is offering precautionary measures to affected individuals, including advice on fraud alerts and security freezes.

Leggett & Platt, Incorporated Employee Benefits Plan was notified of a cybersecurity incident involving MedImpact Healthcare Systems, Inc., a pharmacy benefits manager. The incident, discovered on October 18, 2025, involved unauthorized activity within certain MedImpact systems. A review determined that certain personal data, including first and last name, was potentially impacted. MedImpact has engaged cybersecurity experts, enhanced security safeguards, and is offering resources to affected individuals. There is no current evidence of misuse of the compromised information.

Paradigm Healthcare Services, a third-party service provider processing Medi-Cal billing for the California Department of Health Care Services (DHCS), experienced unauthorized access to its local network on October 13, 2025. An investigation determined that between October 8, 2025, and October 15, 2025, personal information including name, date of birth, gender, and Medi-Cal member identification number may have been accessed by an unauthorized party. Paradigm is offering guidance on protective measures such as fraud alerts and reviewing financial statements.

Aesto, LLC, a healthcare data migration and archiving service provider for Catalyst Physician Group, experienced a network security incident on or about December 18, 2025, impacting a portion of their Amazon Web Services infrastructure. An unauthorized actor may have accessed and/or acquired a limited amount of protected health information, including full name, between December 2, 2025, and December 18, 2025. Aesto has no evidence of misuse but is offering complimentary identity theft protection services through IDX.

zHealth, Inc. disclosed a data breach on January 20, 2026, where unauthorized third-party activity occurred between January 20-21, 2026. The company became aware of the incident on June 15, 2026, and completed its review of potentially impacted data on September 3, 2026. While the specific types of personal information involved are not detailed in the provided text, zHealth is offering affected individuals 12 months of free single bureau credit monitoring and fraud assistance services through Cyberscout, a TransUnion company.

Elixir Medical Corporation experienced a data breach between July 20, 2026, and July 21, 2026, when an unauthorized party gained access to their computer network. The investigation, which concluded on August 11, 2026, determined that human resources information pertaining to current and former employees, consultants, and their beneficiaries/dependents was potentially accessed. The exposed data includes names, Social Security numbers, and potentially driver's license numbers, credit/debit card numbers, medical information, and direct deposit bank account information. Elixir is offering a complimentary membership to Experian's IdentityWorksSM Credit for identity protection.

AdaptHealth, LLC experienced a data breach on June 15, 2026, when an unauthorized third party gained access to company systems through a social engineering attack targeting a single user account on June 5, 2026. The compromised data may include patient names, contact information, demographic information, health insurance details, and health information related to durable medical equipment orders and referring healthcare providers. AdaptHealth has secured the services of Kroll to provide identity monitoring for affected individuals and has reported the incident to law enforcement.

On or about December 18, 2025, Aesto, a healthcare data migration and archiving service provider for Allied Health, experienced a network security incident impacting a portion of its Amazon Web Services infrastructure. An investigation confirmed that between December 2, 2025, and December 18, 2025, an unauthorized actor may have accessed and/or acquired a limited amount of personal information pertaining to patient care, including full name and unspecified variable text. Aesto has no evidence of misuse. Allied Health was notified on June 26, 2026, and confirmed the scope of the impact on July 22, 2026. Affected individuals are offered complimentary credit monitoring and identity theft protection services through Cyberscout.

American Addiction Centers (AAC) disclosed a data breach that occurred on May 12, 2026, involving a third-party vendor. The company learned of suspicious activity in its Salesforce environment on June 5, 2026, and an investigation determined that an unauthorized third party acquired certain information from their Salesforce instance on May 12, 2026. The incident did not involve access to AAC's internal systems, network, or electronic health records. The exposed information included the victim's name, contact information, Social Security number, and a brief description of their health, which was obtained during an initial outreach to AAC and not from their EHR application. AAC is implementing additional safeguards and offering a complimentary membership to Privacy Solutions ID through Epiq for identity protection.

Boston Health Care for the Homeless Program (BHCHP) experienced a data security incident where certain patient or employee personal information may have been accessed or acquired without authorization. The incident was initially learned of on November 11, 2025, and discovered on June 8, 2026. BHCHP has no evidence of misuse of the impacted information. Affected individuals are being offered 12 months of free credit monitoring and fraud assistance services through Cyberscout, a TransUnion company.

Kaniksu Community Health experienced a data incident involving its healthcare data management service provider, Aesto, LLC. The incident occurred on or about December 18, 2025, and Aesto notified Kaniksu on June 26, 2026. Patient data may have been accessed or acquired due to unauthorized access to Aesto's platform. Kaniksu is offering identity monitoring services through Kroll to affected individuals.

Kern Psychiatric Health and Wellness Center, Inc. was notified of a data breach that occurred on June 22, 2026, when their management company, Genesis Healthcare Management, discovered unusual activity on their network. An investigation revealed that certain files containing PWC data were accessed without authorization. The potentially impacted information includes patient names along with sensitive details such as Social Security numbers, driver's license numbers, dates of birth, diagnosis and treatment information, prescription details, provider information, dates of service, medical record and patient account numbers, Medicare/Medicaid IDs, lab results, and health insurance information. Genesis Healthcare Management has implemented additional security measures, notified law enforcement, and is reviewing its data protection policies. The company is offering complimentary credit monitoring and identity protection services to affected individuals.

Aesto, LLC, a healthcare data migration and archiving service provider for Livara Health Medical Group (dba SpineZone), experienced a network security incident impacting a portion of their Amazon Web Services infrastructure. The incident occurred around December 18, 2025, and an investigation confirmed between December 2, 2025, and December 18, 2025, that a limited amount of protected health information, including full names, may have been accessed or acquired by an unauthorized actor. Aesto has no evidence of misuse but is offering complimentary credit monitoring and identity theft protection services from TransUnion.

Murfreesboro Medical Clinic disclosed a data breach on December 2, 2025. The notification letter suggests precautionary measures such as placing fraud alerts and security freezes on credit files, obtaining credit reports, and monitoring financial accounts. The clinic is offering free credit monitoring and identity protection services through Cyberscout, a TransUnion company, for twelve months. Affected individuals are encouraged to enroll within 90 days of the letter's date. The letter also advises reviewing credit reports and account statements for suspicious activity and provides information on fraud alerts.

Aesto LLC, a data migration and archiving service provider for Nebraska Orthopaedic Center, P.C., experienced a network security incident on or about December 18, 2025. The incident impacted a limited portion of their Amazon Web Services infrastructure. An unauthorized actor may have accessed and/or acquired sensitive information between December 2, 2025, and December 18, 2025. The potentially impacted data includes full name, medical record number, date of birth, and Social Security number. Aesto has no evidence of misuse of the information and has notified affected Covered Entities. The incident was contained to Aesto's AWS infrastructure and did not affect the systems of the Covered Entities.

Northern Inyo Healthcare District d/b/a Northern Inyo Hospital experienced a data security incident involving its service provider, Aesto, LLC. On or about December 18, 2025, Aesto experienced a network security incident impacting a portion of its Amazon Web Services infrastructure. A forensic investigation confirmed that between December 2, 2025, and December 18, 2025, a limited amount of protected health information, including full name, may have been accessed or acquired by an unauthorized actor. Aesto has no evidence of misuse but is offering complimentary identity protection services.

Quantum Health, Inc. experienced a data security incident where unauthorized access to their IT network occurred after a user responded to a vishing call on May 29, 2026. Between May 29, 2026, and June 1, 2026, an unauthorized party accessed and acquired files containing personal and health information. The company discovered the service outage related to this unauthorized access on June 1, 2026, and launched an investigation. It was determined on July 8, 2026, that some files contained affected individuals' information. Quantum Health is offering identity monitoring services through Kroll.

Silver Summit Medical Corporation (SSMC), doing business as Digestive Disease Center and Heart Vascular & Leg Center, disclosed a data breach that occurred due to a third-party vendor's cybersecurity event. Between November 27, 2025, and November 30, 2025, unauthorized access to certain data from the vendor's systems resulted in the acquisition of personal and protected health information. The exposed data includes the individual's name. SSMC is offering 12 months of free credit monitoring and identity restoration services through Cyberscout.

Terry J. Dubrow, MD, A Medical Corporation experienced a data security incident where an unauthorized actor gained access to a portion of their network from January 16, 2025. The investigation determined that certain data was acquired. The breach was disclosed on June 21, 2026, with the company learning of the specific impact on July 27, 2026. The exposed data includes patient names, driver's license or state ID numbers, phone numbers, mailing addresses, email addresses, Social Security Numbers, and medical information such as date of birth, prescription details, treatment information, procedure images, and x-rays. The company is offering complimentary identity protection services and has reported the incident to the FBI.

The Health Trust, a non-profit assisting governmental and non-governmental organizations, disclosed a data breach on May 26, 2025. Suspicious activity was first identified on May 26, 2025, leading to network security measures. Further suspicious activity on June 11, 2025, prompted the company to take its systems offline for investigation. The investigation revealed that an unknown actor gained access to certain Health Trust systems prior to March 26, 2025, and again between June 8, 2025, and June 11, 2025, accessing and/or copying information. The affected data, which was processed by their subsidiary FASS, included the recipient's name and other unspecified information. There is no evidence of actual or attempted fraud or identity theft. The Health Trust is offering complimentary credit monitoring services and has reported the event to law enforcement.

Together Women's Health LLC - Aesto disclosed a data breach on December 2, 2025. The notification letter provides guidance on protecting personal information, including placing fraud alerts and security freezes on credit files, obtaining credit reports, and remaining vigilant in reviewing financial statements. It also suggests steps to protect medical information. A dedicated toll-free response line (833-918-8060) is available for questions, staffed by professionals knowledgeable about the incident. The letter also includes information on obtaining an IP PIN from the IRS to prevent tax-related identity theft and directs individuals to resources from the Fair Credit Reporting Act and the Federal Trade Commission, along with state-specific attorney general contact information for Connecticut, District of Columbia, Iowa, Kentucky, and Massachusetts.