healthcare news
28 storiesMedical services company settles with 4 states over 2023 hack of sensitive patient records
Perry Johnson Companies, a Nevada-based medical services provider, has reached a settlement with the attorneys general of Connecticut, New Jersey, New York, and Michigan regarding a significant data breach that occurred in March 2023. The incident, which affected the company’s medical transcription, coding, and imaging subsidiaries, resulted in the exposure of sensitive personal and health…
Belarusian hacktivists admit to 2023 breach of Russian state healthcare network
Belarusian hacktivists have claimed responsibility for a 2023 breach of the Moscow Department of Health, confirming their involvement in an intrusion recently disclosed by a Russian cybersecurity firm. The group, known as the Belarusian Cyber Partisans, stated on Friday that they infiltrated the network and obtained administrator-level access to its infrastructure, which included systems…
Three questions a hospital CISO should ask a healthcare fintech vendor
A cybersecurity expert has outlined key questions hospital CISOs should pose to healthcare fintech vendors to assess their security posture, particularly concerning patient data and financial transactions. Drew McCombs, who holds both CTO and CISO roles at Cylerity, emphasizes that security should be an integral part of development processes, not an afterthought, especially when patient data…
AdaptHealth confirms 4.1 million people exposed in July cyberattack
AdaptHealth, a provider of home medical devices and services, has confirmed that a cyberattack discovered in July exposed the data of 4.1 million individuals. The company offers a range of equipment and services, including those for sleep apnea, respiratory care, oxygen therapy, hospital beds, and mobility.
French hospital fined €500,000 after breach exposes data of 727,000
France's data protection authority, CNIL, has imposed a €500,000 fine on Hôpital privé de la Loire (HPL) following a data breach in the summer of 2025 that exposed sensitive information belonging to over 727,000 individuals. The penalty, equivalent to approximately $580,000, was levied due to the hospital's failure to adequately protect patient data and information pertaining to their…
Healthcare cyberattacks hit pacemakers and millions of patient records
Two major healthcare companies, Boston Scientific and McKesson, have recently disclosed details regarding separate cyberattacks that have impacted their operations and patient data. Boston Scientific, a medical device manufacturer, reported an ongoing cyberattack affecting its IT systems, while pharmaceutical and medical supply giant McKesson confirmed an intrusion with data exfiltration, for…
McKesson copes with fallout from data theft extortion attack
McKesson, a major healthcare sector vendor, has confirmed a cyberattack that resulted in data theft and temporary service disruptions. The company disclosed on Friday, August 29, that attackers gained unauthorized access to some of its third-party applications and exfiltrated data belonging to a subset of customers in its oncology, multispecialty, and medical-surgical business units.
Hackers Are Probing PaperCut Servers, and 47% Still Have No Patch
PaperCut, a widely used print management software, has confirmed active exploitation of a pre-authentication remote code execution vulnerability in its servers, with nearly half of tracked installations remaining unpatched. The flaw, which affects schools, hospitals, and offices globally, was confirmed by PaperCut on August 27, following observations of real-world attacks.
McKesson discloses breach after ShinyHunters claims patient data theft
McKesson, a major U.S. healthcare and pharmaceutical distribution company, has disclosed a cybersecurity incident involving unauthorized access to third-party applications and data exfiltration. The ShinyHunters extortion group has claimed responsibility for the attack, asserting that it stole approximately 284 million patient data records.
Hospital operator Nutex Health says data stolen in cyberattack
Nutex Health, a for-profit healthcare provider operating 28 facilities across 12 states, has confirmed a cyberattack resulted in the exfiltration of data from its servers. The company disclosed the incident in a filing with the U.S. Securities and Exchange Commission (SEC), stating that an unauthorized third party accessed and stole information, some of which may be private or confidential.
Canada’s Hospital for Sick Children attacked by cybercriminals again as employee data stolen
The Hospital for Sick Children (SickKids) in Toronto, Canada, has confirmed a recent cybersecurity incident that resulted in the theft of personal information belonging to current and former employees. This marks the second significant cyberattack against the institution, following a ransomware incident in 2022.
Medical records, SSNs, and bank details exposed in CareCloud data breach
CareCloud, a healthcare technology provider, has confirmed a data breach that exposed the personal and medical information of over 3.75 million individuals. The incident, which occurred in March, involved an unauthorized third party accessing one of the company's Amazon Web Services (AWS) environments.
SickKids data breach exposes employee and job applicant info
The Hospital for Sick Children (SickKids) has disclosed a cybersecurity incident that exposed the personal information of some current and former employees, as well as job applicants. The Toronto-based pediatric hospital confirmed that the breach originated from a vulnerability in a third-party software application used by SickKids and other organizations.
Healthtech firm CareCloud data breach impacts 3.7 million patients
CareCloud, a U.S. healthcare IT company, has confirmed that a data breach earlier this year impacted over 3.7 million individuals. The publicly traded firm, which provides electronic health records, medical billing, practice management, and revenue-cycle services, initially disclosed the incident in March through a filing with the U.S. Securities and Exchange Commission (SEC).
Electronic health record company CareCloud says 3.7 million people affected by breach
CareCloud, a prominent provider of electronic health record (EHR) systems, has confirmed that a data breach in March affected 3,756,469 individuals. The company disclosed to federal regulators that an unauthorized actor gained access to one of its Amazon Web Services (AWS) environments, remaining undetected for approximately eight hours.
Oracle August 2026 Critical Security Patch Update Addresses 925 CVEs
Oracle has released its August 2026 Critical Security Patch Update (CSPU), addressing 925 unique Common Vulnerabilities and Exposures (CVEs) through 943 security updates across 23 of its product families. This update includes 154 critical severity patches, accounting for 16.3% of the total fixes.
LiteLLM Supply-Chain Attack – Technology, Banking and Healthcare the Most Affected
A supply-chain attack targeting LiteLLM, a popular open-source AI gateway and utility library, has led to the exposure of credentials across more than 2,000 code repositories, impacting a wide range of organizations, particularly in the technology, finance, and healthcare sectors. The threat actor group, identified as TeamPCP, compromised maintainer credentials for LiteLLM and published…
Poland probes MyDr healthcare software breach potentially affecting 19 million people
Polish authorities are investigating a cyberattack against the healthcare software provider MyDr, which may have exposed data belonging to approximately 19 million individuals and over 12,000 medical facilities. MyDr, a private Polish company that supplies software to various healthcare providers, confirmed on Friday that it had identified and remediated the cause of the incident and…
Post-quantum migration gets harder when every user holds a key
The transition to post-quantum cryptography presents significant challenges, particularly in systems where individual users manage their own cryptographic keys, such as blockchains. Experts note that the increased key and signature sizes required by new algorithms can break assumptions in older protocols and systems, while the decentralized nature of user-held keys complicates large-scale…
Unlimited Technology Systems Data Breach Exposes Data of 3.8 Million Healthcare Patients
Unlimited Technology Systems, a healthcare technology provider based in Montgomery, Ohio, has disclosed a data breach affecting over 3.8 million individuals. The company confirmed that unauthorized actors accessed one of its commercial data centers between October 5 and October 10, 2025, potentially compromising personal, medical, and insurance information.
Unlimited Technology Systems breach impacts 3.8 million people
Unlimited Technology Systems, a healthcare software provider, has confirmed a data breach impacting over 3.8 million individuals. The company specializes in financial and revenue cycle technology for specialty healthcare providers, serving approximately 4,500 clinics and 6,500 providers across the United States.
Scot NHS trust probes access to medical records of 9-year-old girl after man arrested on suspicion of murder
NHS Tayside is investigating an alleged data breach involving the medical records of nine-year-old Minnie Merriman, who died earlier this week. The investigation centers on whether staff at Ninewells Hospital in Dundee improperly accessed her file without authorization or clinical necessity.
Healthcare and Victim Support Charities Affected by Beacon Cyber Incident
A cyber incident affecting Beacon, a third-party customer relationship management (CRM) provider, has potentially led to data breaches for approximately 1,500 UK charities, including those in the healthcare and victim support sectors. The company publicly disclosed the incident on August 4, 2026, and confirmed it had notified all its customers by August 6.
Ransomware Surges in July After Q2 Lull
Ransomware attacks saw a significant increase in July, rising by 19% compared to June, according to an analysis published on August 5. This surge followed a period of relative calm in April, May, and June, making July the second most active month for ransomware in 2026 and the third highest in the past 17 months. A total of 799 claimed ransomware attacks were observed during July.
Brown Health Medical Group-MA Data Breach Exposes Information of 311,000 Individuals
Brown Health Medical Group-MA has confirmed a data breach affecting over 311,000 individuals, exposing personal, medical, and financial information after unauthorized access to a legacy file server. The healthcare provider identified the security incident on December 16, 2025, and an investigation determined that the unauthorized access occurred between December 15 and 16, 2025.
Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts
Microsoft has confirmed a global campaign targeting hospitality Wi-Fi networks, which it attributes to the Russian state-sponsored threat actor Midnight Blizzard, also known as APT29. The campaign, dubbed "CaptiveCrunch" by Microsoft, has been active since at least early May, though the threat actor has engaged in device and OAuth code phishing operations since February.
Suspected Chinese-Speaking Hackers Target Central Asian Governments With OctLurk and SilkLurk
A suspected Chinese-speaking threat actor has reportedly launched a new series of cyberattacks targeting government organizations primarily in Central Asian nations, including Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, and Kazakhstan, as well as the Syrian Arab Republic. The campaign, which has been active since January 2025, reportedly leverages custom malware identified as OctLurk and…
Oracle July 2026 Critical Patch Update Addresses 1235 CVEs
Oracle released its July 2026 Critical Patch Update (CPU), addressing 1,235 unique Common Vulnerabilities and Exposures (CVEs) across 32 product families. This quarterly update, the third for 2026, includes a total of 1,449 security patches, making it the largest CPU release to date.