Latest cybersecurity reporting from selected sources.

Business Associates Tied to 50% of Breach Victims as AI-Aided Attacks LoomVendor incidents and hacks, especially data thefts and ransomware attacks, continue to plague the healthcare sector, accounting for the majority of major data breaches reported so far this year. The advent of AI tools in the hands of bad actors, will only heighten the threats, experts predict.

As hospital-at-home programs expand and AI adoption accelerates, healthcare organizations face mounting cloud security demands. Anahi Santiago, CISO of ChristianaCare, discusses vendor accountability, identity management, clinical AI risks and the need for stronger cybersecurity foundations.

Study: Monitoring Vendor Risk Remains Much Harder Than Onboarding Third PartiesHealthcare organizations are getting better vetting third-party vendors, including suppliers of medical devices, software and other products. But once these vendors are on board, healthcare firms still struggle with monitoring their security posture and ensuring they keep their promises.

The Oncology Institute disclosed a data breach tied to a third-party vendor, potentially exposing patient information after a 2025 cyberattack. The Oncology Institute has confirmed that patient information was impacted in a cybersecurity incident involving a third-party software provider. The healthcare network first disclosed the security breach in November 2025 while the vendor’s investigation was […]

Ransomware and vendor breaches persist. The "2026 Data Breach Investigations Report" (DBIR) highlights how evolving social engineering tactics make the sector more vulnerable.

Incident Involved an Unnamed Third-Party VendorNew York City's municipal healthcare system is notifying nearly 2 million patients of a hacking incident discovered earlier this year involving a third-party vendor. The breach compromised a long list of information, including biometric data such as fingerprints.

Playbook Aims to Help Healthcare, Public Sector Manage AI Vendor Security GapsThe Health Sector Coordinating Council released guidance to help the healthcare and public health sector better manage the explosion of third-party AI vendor cyber risk concerns they face, especially as the technology is embedded in all sorts of products.

Former DoD CIO Beavers on Ethics, Reliability and AI as a National Security ToolAs AI is increasingly used in defense operations, a critical question emerges: Who controls the system - the military or the model? Former DoD CIO Leslie Beavers explores challenges related to ethics and reliability, vendor risk, and autonomy as AI tools become key combatants in modern warfare.

Dutch healthcare software vendor ChipSoft has been impacted by a ransomware attack that forced the company to take offline its website and digital services for patients and healthcare providers. [...]

ChipSoft's website remains down but emails are functioning A Dutch healthcare software vendor has been knocked offline following a ransomware attack, officials say.…

Also: RSAC Speakers Warn AI Is Outpacing Security, DoD's Zero Trust Reality CheckIn this week's panel, four ISMG editors discussed growing cyber risks in healthcare following recent vendor breaches, key takeaways from RSAC Conference and whether the Pentagon's zero trust push is delivering real security benefits or just checking off boxes.

Why Remote Access to Industrial Operations Is the Biggest Unmanaged RiskRemote access has become one of the largest unmanaged attack surfaces in industrial operations. Legacy VPNs and jump servers expose OT environments to serious risk. Learn how Cisco Cyber Vision's Secure Equipment Access can secure vendor and engineer access while protecting critical infrastructure.

Why Governance, Access Control and Vendor Oversight Now Define Patient SafetyHealthcare breaches do not start with a single technical failure. Digital risk has become clinical risk, driven by weak governance, excess access and unmanaged vendors. Resilience now depends on governance, not more tooling.

Compromise Affects Healthcare Clients of Co.'s Revenue Cycle Management ServicesBilling services vendor Trizetto Provider Solutions is notifying 3.4 million individuals of a hacking incident discovered in October 2025 that investigators have now determined started nearly a year earlier, when threat actors accessed the company's healthcare clients' insurance related data.

Why Governance, Access Control and Vendor Oversight Now Define Patient SafetyHealthcare breaches do not start with a single technical failure. Digital risk has become clinical risk, driven by weak governance, excess access and unmanaged vendors. Resilience now depends on governance, not more tooling.

Breach Affected More Than a Dozen Healthcare Clients, 2.5M PatientsElectronic health records vendor Veradigm agreed to pay $10.5 million to settle consolidated class action litigation involving a December 2024 hacking incident discovered in mid-2025 that affected more than a dozen healthcare provider clients and about 2.5 million of their patients.

State Monitoring Incident Involving a Health Entity Worker for Potential FraudThe Minnesota Department of Human Services is notifying nearly 304,000 people of data breach involving someone at a healthcare provider who inappropriately accessed information from an IT system managed by a vendor. State officials are monitoring the incident for potential fraud.

Suit Alleges Competitor Lets 'Shell Firms' Exploit National Data ExchangesElectronic health records giant Epic Systems is accusing a rival health information network vendor, Health Gorilla, of enabling a syndicate of "sham" entities "masquerading" as healthcare providers to improperly access patient records from national health data exchanges in pursuit of money.

The Edmund Group's Adler on Managing Third- and Fourth-Party Risk in HealthcareHealthcare organizations face growing risks from data distribution, vendor dependencies and global instability. Steven Adler, partner at The Edmund Group, discusses practical steps to strengthen vendor oversight and resilience.

Recent Incidents Highlight Patient Record Cyber Risks Tied to Third-Party SuppliersVendor security risk has long been a source of pain for many healthcare providers. Veradigm - formerly Allscripts - and ApolloMD are among the latest software and services vendors reporting hacking incidents potentially triggering headaches for customers and their patients.