Nutex Health, a for-profit healthcare provider operating 28 facilities across 12 states, has confirmed a cyberattack resulted in the exfiltration of data from its servers. The company disclosed the incident in a filing with the U.S. Securities and Exchange Commission (SEC), stating that an unauthorized third party accessed and stole information, some of which may be private or confidential.
The company, which reported an annual revenue of $875 million in 2025 and is publicly traded on the Nasdaq Capital Market under the ticker NUTX, initiated its cybersecurity response plan immediately upon detecting the intrusion. This included implementing containment measures, engaging external incident-response and forensic specialists, and notifying law enforcement authorities.
As of August 24, Nutex Health stated that it had not identified any material impact on its operational capabilities or financial reporting systems. The company also indicated that it does not currently anticipate the incident will significantly affect its business strategy, overall operations, financial condition, or results.
The ongoing investigation aims to determine the precise nature and extent of the compromised data. Nutex Health is still assessing whether patient, employee, credentialed provider, confidential business and financial information, intellectual property, or other sensitive data may have been accessed, acquired, or exfiltrated. The potential impact of any subsequent disclosure of this information by the unauthorized third party is also being evaluated.
Facilities operated by Nutex Health include the Bayou City ER & Hospital in Texas and Green Bay ER & Hospital in Wisconsin. The company has not yet confirmed if the stolen data involves information pertaining to patients, employees, or business partners specifically.
At present, no threat actor has publicly claimed responsibility for the attack on Nutex Health. The company has not provided further details beyond its SEC filing regarding the incident.
