Latest cybersecurity reporting from selected sources.

Properly Configured Mobile Development Management Tools Can't Wipe Personal DataMobile device management software is having a moment of notoriety after Iran-aligned hacking group Handala used Microsoft Intune to wipe the mobile devices of employees at medical device manufacture Stryker. Tens of thousands of personal devices were likely affected.

Health Researchers Often Overlook Security of Historical DatasetsAn August 2025 ransomware attack on the University of Hawaii Cancer Center's epidemiology division has affected 1.2 million individuals, including personal information such as Social Security numbers of certain research study participants dating back more than 30 years.

Regulators Cite Sales of Sensitive Health, Demographic DataCalifornia state regulators fined a Texas company that buys and sells data for targeted marketing, including lists pertaining to health conditions of older adults, as part of a crackdown on data brokers. The firm is now banned from selling all Californians' personal information.

Insurer's Hack Could Rank as Largest US Health Data Breach Reported in 2025Supplemental health insurer Aflac is notifying 22.65 million people whose sensitive health and personal information, including Social Security numbers, was potentially compromised in a June data theft incident. The incident will likely rank as the biggest U.S. health data breach reported in 2025.

Insurer's Hack Could Rank as Largest US Health Data Breach Reported in 2025Supplemental health insurer Aflac is notifying 22.65 million people whose sensitive health and personal information, including Social Security numbers, was potentially compromised in a June data theft incident. The incident will likely rank as the biggest U.S. health data breach reported in 2025.

Ransomware Gang Rhysida Leaks 3.7TB of Data Stolen From Maryland Hospital SystemMaryland-based MedStar Health, which operates 10 hospitals, is notifying patients about a data theft incident affecting their personal information. Ransomware group Rhysida claims on its darkweb leak site to have 3.7 terabytes of MedStar's data, including "over 7 million pieces of patient data."

Data of Nearly 470,000 Patients and Employees May Have Been Leaked on Dark WebOmni Family Health, a California nonprofit network of community health centers, has agreed to pay $6.5 million to settle proposed class action lawsuits related to a 2024 hack that may have exposed the personal information of nearly 470,000 current and former patients and employees on the dark web.

Absolute Dental Says Breach Involved Third-Party Managed Services FirmA Nevada dental practice is notifying more than 1.2 million individuals of a hacking incident that compromised sensitive health and personal information. The incident involved "inadvertent execution of a malicious version of a legitimate software tool," said Absolute Dental.

Settlement Includes Corrective Action Plan Focused on Improving Risk AnalysisAn investigation into a ransomware breach reported in 2020 as affecting the protected personal information of 170,000 people led to a $175,000 fine against a certified public accounting and consulting firm. Regulators also required the company to implement a corrective action plan in the settlement.

345 Major HIPAA Breaches Reported to Feds So Far This Year, Affecting 29.9 MillionMidway through 2025, the federal website listing major health data breaches in the U.S. shows a familiar scene: Many hacking incidents including ransomware, dozens of third-party vendor incidents, and millions of individuals affected by compromised personal data.

Alerts Come on the Heels of Recent Attacks on InsurersU.S. federal authorities are warning the public and healthcare sector entities of email and fax phishing scams by fraudsters seeking to steal personal information about patients or payments. The warnings come as three large U.S. insurers continue to recover from recent cyberattacks.

Personal Data Stolen in Ransomware Hit, Says Dutch Owner of Stop & Shop, Giant FoodFood retail giant Ahold Delhaize USA is notifying 2.2 million current and former employees, as well as an unspecified number of employees in the Netherlands, that a November 2024 data breach exposed their personally identifiable information, including Social Security numbers and medical details.

Community Dental Care Is State's Largest Non-Profit Serving Medicaid PatientsMinnesota's largest nonprofit Medicaid dental practice is notifying nearly 135,000 people of a December 2024 data theft incident that potentially compromised their health and personal information, ranging from medical information to passport numbers.

Experts Cast Nervous Eye on Musk and Team's Handling of Health-Related InfoPrivacy experts are keeping a nervous eye on the potential for compromises involving Americans' health and personal information resulting from the White House's Department of Government Efficiency - led by Elon Musk - accessing government IT systems containing Medicare and health related data.

7 Texas Health and Human Services Workers Fired in Incident Affecting 61,000 peopleAuthorities in Texas are investigating an insider incident at the Texas Health and Human Services Commission that led to the firing of seven employees, an investigation into hundreds of thousands of dollars in stolen funds and notification of a breach of personal information affecting 61,000 people.

Attack on Blood Center Spotlights Ongoing Supply Chain Risk in Healthcare SectorSix months after a ransomware attack temporarily crippled its blood donation and distribution activities, Florida-based nonprofit OneBlood is reporting a data breach to regulators that affected donors' personal information. Why is the incident reawakening healthcare supply chain concerns?

Inmediata Health Group Has Paid $2.7M in Fines, Civil Claims for 2019 HIPAA BreachA breach that exposed the personal information of nearly 1.6 million patients of a Puerto Rico-based clearinghouse has led to a $250,000 financial settlement with federal regulations for multiple HIPAA violations. The 2019 leak has cost Inmediata Health $2.7 million in fines and civil settlements.

Incident Is Among Growing List of Attacks on Small, Rural HospitalsAn Oklahoma hospital quickly restored its IT systems after a ransomware attack in September, but the 62-bed hospital could not recover some data and later learned that hackers may have accessed the personal information of 133,000 people. The attack is the latest involving a small rural hospital.

Young Consulting Says Health Data Exposed; Ransomware Group Leaked Stolen DataYoung Consulting, which develops software for the stop-loss insurance market, is notifying 1 million individuals that their personal information was stolen earlier this year in a hack attack. The BlackSuit ransomware group, a rebrand of Royal, subsequently claimed credit and leaked stolen data.

Nearly 137,000 People Affected in 2023 Ransomware Attack on Maryland-Based HospitalA ransomware attack against Berlin, Maryland-based Atlantic General Hospital that affected the personal information of 137,000 individuals in 2023 has led to a $2.25 million preliminary settlement of a consolidated proposed federal class action lawsuit.