Latest cybersecurity reporting from selected sources.

University of Hawaii Cancer Center Paid RansomCancer patients who participated in University of Hawaii Cancer Center studies during the 1990s may soon receive a notification that ransomware hackers stole their data in an August 2025 incident. Experts said the hack spotlights concerning risks involving compromises of medical research data.

Texas-Based Harris Health Says FBI Just Gave Green Light to Notify 5,000 PatientsHarris Health is contacting 5,000 patients about a breach involving a former employee who improperly accessed electronic health records for over a decade. The Texas health entity said it discovered and reported the incident four years ago to the FBI, which just gave the green light for notification.

Horizon Healthcare RCM Hints at Paying Ransom in Data Theft IncidentHorizon Healthcare RCM is the latest revenue cycle management software vendor to report a health data breach involving ransomware and data theft. The firm's breach notification statement suggests that the company paid a ransom to prevent the disclosure of its stolen information.

United Natural Foods, Inc. Launches Investigation, Confirms IT Systems BreachA cyberattack on United Natural Foods, the largest U.S. health food distributor and a key Whole Foods supplier, has disrupted the company's fulfillment operations, prompting a notification to law enforcement and a forensic investigation as it works to restore affected systems.

7 Texas Health and Human Services Workers Fired in Incident Affecting 61,000 peopleAuthorities in Texas are investigating an insider incident at the Texas Health and Human Services Commission that led to the firing of seven employees, an investigation into hundreds of thousands of dollars in stolen funds and notification of a breach of personal information affecting 61,000 people.

Industry Associations Want Feds to Put Regulatory Onus on Change HealthcareTwo weeks ago, Change Healthcare began notifying thousands of medical practices about a massive data breach affecting millions of patients. The healthcare software firm says it will handle breach notifications, but industry groups want to ensure the government will go along with that plan.

Bipartisan U.S. Senators Demand Change Healthcare Breach Notification by June 21Two U.S. senators are demanding UnitedHealth Group report a HIPAA breach and notify affected individuals no later than June 21, alleging the company is already violating HIPAA by dragging out the notification process in the aftermath of the Feb. 21 cyberattack on Change Healthcare.

HHS OCR Advises HIPAA-Covered Entities to Coordinate Notification Duties With UHGTens of thousands of hospitals and medical practices can breathe a little easier now. Federal regulators have given the green light for Change Healthcare to handle the breach notification to tens of millions of individuals affected in a February cyberattack. But the devil is in the details.

Regs Now Cover Wearables and Health Apps, Extend to More Types of BreachesThe Federal Trade Commission has finalized changes to its Health Breach Notification Rule, expanding the type of technologies that apply to regulations pertaining to non-HIPAA-regulated entities. The rule has been on the books for about 15 years, but the agency only recently began to enforce it.

UnitedHealth Group Makes Low Key Admission in Online FAQUnitedHealthGroup said for the first time that hackers behind a February ransomware attack against Change Healthcare breached sensitive health information, an admission that triggers a regulatory countdown clock for public disclosures and individual notification.

AHA Wants Change Healthcare on Hook for Notification in Potential BreachAs thousands of hospitals, clinics and doctor practices potentially have to notify millions of patients about the Change Healthcare breach, the American Hospital Association said the IT services firm and parent company, UnitedHealth Group, should be the sole sender of notifications.

Plaintiffs claim hospital didn't secure data and worsened the situation by delaying notification

Managed Care of North America (MCNA) Dental has published a data breach notification on its website, informing almost 9 million patients that their personal data were compromised. [...]

All that data coming soon to a darkweb crime forum near you? Several California medical groups have sent security breach notification letters to more than three million patients alerting them that crooks may have stolen a ton of their sensitive health and personal information during a ransomware infection in December.…

As many as eight zero-day vulnerabilities have been disclosed in Carrier's LenelS2 HID Mercury access control system that's used widely in healthcare, education, transportation, and government facilities