Latest cybersecurity reporting from selected sources.

Health Researchers Often Overlook Security of Historical DatasetsAn August 2025 ransomware attack on the University of Hawaii Cancer Center's epidemiology division has affected 1.2 million individuals, including personal information such as Social Security numbers of certain research study participants dating back more than 30 years.

Full Scope of Clop Ransomware Group's Oracle E-Business Suite Hits Still EmergingThe University of Phoenix is notifying 3.5 million individuals that their personal information was compromised in a data breach. The theft traces to the Clop ransomware group's supply-chain campaign against users of Oracle E-Business Suite, in which it wield two zero-day vulnerabilities.

Ransomware Gang Rhysida Leaks 3.7TB of Data Stolen From Maryland Hospital SystemMaryland-based MedStar Health, which operates 10 hospitals, is notifying patients about a data theft incident affecting their personal information. Ransomware group Rhysida claims on its darkweb leak site to have 3.7 terabytes of MedStar's data, including "over 7 million pieces of patient data."

Settlement Includes Corrective Action Plan Focused on Improving Risk AnalysisAn investigation into a ransomware breach reported in 2020 as affecting the protected personal information of 170,000 people led to a $175,000 fine against a certified public accounting and consulting firm. Regulators also required the company to implement a corrective action plan in the settlement.

345 Major HIPAA Breaches Reported to Feds So Far This Year, Affecting 29.9 MillionMidway through 2025, the federal website listing major health data breaches in the U.S. shows a familiar scene: Many hacking incidents including ransomware, dozens of third-party vendor incidents, and millions of individuals affected by compromised personal data.

Personal Data Stolen in Ransomware Hit, Says Dutch Owner of Stop & Shop, Giant FoodFood retail giant Ahold Delhaize USA is notifying 2.2 million current and former employees, as well as an unspecified number of employees in the Netherlands, that a November 2024 data breach exposed their personally identifiable information, including Social Security numbers and medical details.

7.2 Million Individuals' Personal Data Being Held to Ransom by Threat ActorA data-leak group extortion is shaking down the government of Paraguay for a ransom payment worth $7.4 million, or $1 for every one of the country's citizens. The group, calling itself Brigada Cyber PMC, claims the stolen data includes people's personally identifiable information.

Not Just Ransomware But Verbal Disclosure of Personal Data Common, Watchdog FindsTwo decades after California Senate Bill 1386 introduced the world to data breach notifications, organizations have collectively battened down their cybersecurity hatches and fixed the problem once and for all. Of course, I'm joking, with the results of recent data breach root cause report in hand.

Ransomware Attack in 2023 Affected More Than 6 Million PeopleIndian IT services giant Infosys said its U.S. subsidiary Infosys McCamish Systems agreed to pay $17.5 million to settle six class action lawsuits related to a cybersecurity incident that compromised the personal information of more than 6 million people.

Attack on Blood Center Spotlights Ongoing Supply Chain Risk in Healthcare SectorSix months after a ransomware attack temporarily crippled its blood donation and distribution activities, Florida-based nonprofit OneBlood is reporting a data breach to regulators that affected donors' personal information. Why is the incident reawakening healthcare supply chain concerns?

Incident Is Among Growing List of Attacks on Small, Rural HospitalsAn Oklahoma hospital quickly restored its IT systems after a ransomware attack in September, but the 62-bed hospital could not recover some data and later learned that hackers may have accessed the personal information of 133,000 people. The attack is the latest involving a small rural hospital.

Young Consulting Says Health Data Exposed; Ransomware Group Leaked Stolen DataYoung Consulting, which develops software for the stop-loss insurance market, is notifying 1 million individuals that their personal information was stolen earlier this year in a hack attack. The BlackSuit ransomware group, a rebrand of Royal, subsequently claimed credit and leaked stolen data.

Nearly 137,000 People Affected in 2023 Ransomware Attack on Maryland-Based HospitalA ransomware attack against Berlin, Maryland-based Atlantic General Hospital that affected the personal information of 137,000 individuals in 2023 has led to a $2.25 million preliminary settlement of a consolidated proposed federal class action lawsuit.

UnitedHealth Group Makes Low Key Admission in Online FAQUnitedHealthGroup said for the first time that hackers behind a February ransomware attack against Change Healthcare breached sensitive health information, an admission that triggers a regulatory countdown clock for public disclosures and individual notification.

Customers 'Sensitive Personal Information' Stolen, Large Mortgage Lender ReportsNon-bank mortgage lending giant LoanDepot says hackers stole "sensitive personal information" pertaining to 16.6 million customers when they breached its systems earlier this month as part of a ransomware attack. The company said it will directly notify all affected customers.

1.3 Million Customers Notified of Breach; BlackCat Ransomware Group Claimed CreditFinancial services giant Fidelity National Financial has confirmed that a November 2023 hack attack compromised personal information pertaining to 1.3 million customers of its LoanCare subsidiary. FNF took multiple systems offline when responding to the attack, disrupting some homebuyers.