healthcare6 articles
iRhythm Breach Hits 360,000+ Patients After Ransomware Crew Steals Medical Data
Medical device company iRhythm suffered a data breach between June 3–8, in which hackers accessed and stole personal information — including names, addresses, dates of birth, and account details — from third-party-hosted business applications. At least 360,000 patients have been notified, though the total number affected is likely higher. The attackers subsequently threatened to leak the stolen data unless a ransom was paid, and iRhythm's statement that there is no evidence of the data being misused suggests the company may have complied with the demand.
4.1 Million Patients Hit as AdaptHealth Suffers Cloud Breach
A data breach at US healthcare company AdaptHealth compromised the personal, health, and insurance information of over 4.1 million individuals after a threat actor used social engineering to access cloud-based systems in early June. The attacker exfiltrated names, contact details, and health and insurance information, though Social Security numbers and financial data were reportedly unaffected. A separate breach at clinical genomics company Baylor Genetics, also occurring in June, impacted nearly 2.8 million individuals, with hackers stealing a broader range of data including Social Security numbers and employee financial information.
Madera Community Hospital Took a Year to Tell 150,000 People Their Data Was Stolen
Madera Community Hospital in California has notified over 150,000 individuals that their personal, financial, and medical information was compromised in a cyberattack that occurred in May 2025. Hackers accessed the hospital's network for two days and likely exfiltrated files containing sensitive data, including Social Security numbers, health insurance details, and biometric information, though the hospital found no evidence the data was publicly released. The extortion group behind the attack ultimately withdrew its ransom demand, claiming it did not want to harm patients.
3.8 Million Patient Records Exposed in Ohio Healthcare Software Breach
Ohio-based healthcare software company Unlimited Technology Systems (UTS) has confirmed a data breach affecting 3.8 million people, making it the largest healthcare breach reported to US regulators so far in 2026. Hackers accessed its systems between October 5–10, 2025, potentially stealing sensitive personal, medical, and insurance data, including Social Security numbers, diagnoses, and government ID scans. UTS has notified law enforcement, engaged a forensic security firm, and is offering affected individuals 24 months of credit monitoring and identity protection services.
How Complaining About a Doctor Got a Red Teamer Into a Restricted Hospital Records Room
A red teamer named Dahvid Schloss successfully infiltrated a hospital's secure records room using social engineering — by wearing scrubs, carrying a fake badge, and bonding with a nurse over complaints about a real, notoriously difficult doctor. He also discovered serious network security flaws at other hospitals, where medical devices transmitted sensitive patient data, including Social Security numbers, unencrypted over the same Wi-Fi network as guests. The incidents highlight how human trust and poor network segmentation can be just as dangerous as technical vulnerabilities in healthcare settings.
Clover Health Investments Hit by Social Engineering Attack, Patient Data Exposed
Clover Health Investments disclosed a data breach discovered on July 4, resulting from a social engineering attack that compromised three non-managerial employee accounts with access to personal and protected health information. The company activated its response plan, engaged third-party cybersecurity experts, and believes the attackers have been evicted, though the full scope of the breach remains undetermined. No threat actor or ransomware group has claimed responsibility for the incident.