Incidents in sector:
Home medical equipment provider AdaptHealth disclosed a material cybersecurity incident in which a social-engineering attack on a third-party contractor let a threat actor into its cloud systems and reach patient personal and health information.
Medical device maker Medtronic began notifying roughly 3.8 million people that their personal data was exposed when the ShinyHunters extortion group accessed its corporate IT systems in April 2026.
Xsolis, a US healthcare AI vendor, disclosed that a January phishing attack exposed the personal and protected health information of nearly 1.4 million people.
Michigan's largest federally qualified health center, Cherry Health, posted a preliminary breach notice on 18 June 2026 after suspicious network activity detected in April triggered a days-long outage and the copying of patient and staff data, including Social Security numbers.
Google's Threat Intelligence Group disclosed that PRC-nexus actor UNC6508 spent more than a year inside U.S. and Canadian medical, academic and military-health research environments, compromising legacy REDCap servers, deploying custom INFINITERED malware and abusing Google Workspace email compliance rules to silently exfiltrate research and defense data.
Danish pharmaceutical giant Novo Nordisk disclosed that attackers copied pseudonymised patient information from some of its clinical trials out of its internal IT systems, prompting it to take certain systems offline while it investigates.
Dental benefits administrator DentaQuest confirmed a network breach after the extortion group ShinyHunters leaked roughly 234 GB of stolen data, exposing personal, identity, and health-insurance information tied to about 2.6 million accounts.
In May 2026, French third-party health-payment operator Almerys disclosed a breach after a database of more than 44 million records โ including 15.4 million unique social security numbers, names, birthdates and insurance details โ was offered for sale on a cybercrime forum.
On 11 May 2026, a dataset attributed to CalendrIDEL, a French scheduling platform for self-employed nurses, was posted on a cybercrime forum, exposing the email addresses, mobile numbers, postal codes and profile names of roughly 1,400 nurses.
The Ambroise Parรฉ clinic in Beuvry says it was the victim of a cybersecurity incident on 21 April 2026, according to a communication published on 30
On 21 April 2026, French medical-packaging manufacturer Sterimed was claimed by the Qilin ransomware group, which published internal files โ technical documents, project data, HR records, IT-security material and system backups โ on its dark-web leak site.
The Clinique de l'Yvette in Longjumeau is reportedly targeted by a cyberattack, with data put online and administrator access claimed by a
On 6 April 2026, Bordeaux-based healthcare software publisher YMED, which runs the SOONCAREยฎ appointment platform, was hit by an extortion attack claimed by the group XP95, which exfiltrated 132 GB of data covering 253,342 patients and over 431,000 medical files.
On 5 April 2026, the DumpSec group advertised for sale a database it claims covers 35 million French patients tied to France's Regional Health Agencies (ARS), more than 130 hospitals and AP-HP, exposing identities, social security numbers and health records.
Following our article published on 5 April 2026, the company Nosho wanted to provide several clarifications on the incident: An attack on our database
On 25 March 2026, French medical-laboratory network Cerballiance disclosed a breach traced to a compromised external IT provider that exposed patient identities, portal credentials, medical test reports and social security numbers.
La Mutuelle Familiale, a French complementary health insurer, disclosed a computer intrusion detected on 17 March 2026 that potentially affected its roughly 113,000 members, exposing identity documents, bank details (RIB) and health and insurance data.
On 13 March 2026, a threat actor claimed to have leaked a database belonging to GPS Santรฉ, a French health-tech firm offering online medical scheduling and teleconsultation, allegedly exposing data on roughly 890,000 patients and practitioners.
On 13 March 2026, a dataset claimed to come from the French therapist-booking platform Therapeutes.com was put up for sale, exposing around 71,502 patients along with nearly 199,697 appointment records and highly sensitive mental-health consultation details.
On 12 March 2026, French alternative-medicine booking platform Medoucine confirmed a data breach in which a database of 813,866 users โ including about 6,500 practitioners โ was put up for sale, exposing names, emails, phone numbers and consultation history.
The Iranian state-linked group Handala compromised Stryker's Microsoft Intune administrator account and used the endpoint-management tool to wipe more than 200,000 servers, mobile devices, and corporate endpoints across 79 countries โ bringing operations at one of the world's largest medical-device makers to a halt.
On 7 March 2026, a threat actor claimed a data leak at Ordoclic, a French e-prescription and e-health provider, allegedly exposing data on nearly 4,600 people including patients and business contacts; the claim remains unverified.
On 7 February 2026, a threat actor claimed a data leak from French eldercare platform CetteFamille, exposing the names, email addresses and account status of around 12,711 coordinators across roughly 333,000 documents (about 41 GB).
On 5 February 2026, the threat group RavenSec claimed a breach of France's ADMR home-care network, leaking member data โ names, email and postal addresses and organisation details โ with over 10,000 people initially affected and a claimed underlying database of millions.
On 5 February 2026 a threat actor claimed to be selling a database holding the professional email addresses of 15,108 staff of France's Agence Rรฉgionale de Santรฉ (ARS), alongside other work-related details, on a cybercrime forum.
On 5 February 2026, a threat actor known as sux1337 claimed to have leaked 7,665 lines of patient data from Asten Santรฉ, a French home-healthcare provider, publishing the records for free on a cybercrime forum days before the company suspended its patient and prescriber extranets for security reasons.
On 5 February 2026, a threat actor claimed to have leaked roughly 4,000 lines of data concerning authorising officers (agents ordonnateurs) at France's Centre National de Gestion, the public body managing HR for hospital practitioners and healthcare directors.
On 31 January 2026, a dataset advertised on BreachForums as the 2026 directory of French locum (replacement) doctors was claimed to expose roughly 23,535 records, including names, emails, phone numbers and professional practice-authorisation numbers.
In January 2026, a data breach impacting the French non-profit Association Nationale des Premiers Secours (ANPS) was posted to a hacking forum. The breach exposed 5.6k unique email addresses along with names, dates of birth and places of birth.
On 28 January 2026, patient personal data from the Centre d'Imagerie Mรฉdicale de Puteaux โ a radiology and medical imaging centre in the Hauts-de-Seine โ was exposed in a confirmed data breach, including names, dates of birth, contact details and appointment history.
On 26 January 2026, Lyleoo, a French ophthalmology tele-expertise platform, confirmed a data breach after attackers used a partner optician's stolen credentials to access its systems; the DumpSec group leaked about 900,000 records of user contact details.
Breach of the MonLogicielMedical (MLM) practice software by Cegedim Santรฉ, disclosed to affected doctors in early January 2026, exposing patient administrative records โ name, date of birth, address, social-security scheme โ for up to 11โ15 million patients via compromised doctor accounts.
On 10 January 2026, a threat actor advertised on BreachForums a database allegedly stolen from French home-respiratory-care provider SOS Oxygรจne, claiming roughly 146,605 unique patients with names, full postal addresses and GPS coordinates exposed.
On 5 January 2026, French home-care franchise network Petits-fils confirmed a data leak exposing roughly 1,050 identities of staff and collaborators across its network of agencies and franchises.
On 2 January 2026, a data leak was claimed against AFPPCD-IDF, a Paris-based dental-assistant training association, exposing personal records on roughly 24,000 trainees including names, dates and places of birth, contact details and French social-security (NIR) numbers.
In December 2025, the EHPAD Rรฉsidence du Parc nursing home in Champdeniers-Saint-Denis (Deux-Sรจvres, France), home to around 90 residents, was hit by a ransomware attack that encrypted files and dropped a $5 million ransom note; administrative data and possibly scanned ID documents were exposed.
MรฉdecinDirect, the French teleconsultation platform (a Teladoc Health subsidiary), disclosed on 3 December 2025 a data breach detected on 28 November exposing the personal and health data of around 285,000 patients, with a threat actor claiming up to 323,069 records.
Patient data held by the Givors Presqu'รle multidisciplinary health centre was exposed through the November 2025 cyberattack on its medical-software provider Weda, including identity, contact details and sensitive health data.
Clinique du Millรฉnaire in Montpellier was exposed when its medical-records software vendor Weda was breached in November 2025, putting patient identity, contact details and health data at risk among the millions of records handled across Weda's ~23,000 affected practitioners.
In November 2025, Itelis โ a French optical health-care network linked to AXA โ disclosed a breach exposing roughly 1.6 million beneficiaries' identity and optical-reimbursement data, including names, dates of birth and social security numbers.
MSP du Prรฉ Vicinal, a French multidisciplinary health centre, had patient data exposed via the November 2025 cyberattack on its medical-software provider Weda, including names, postal and email addresses, phone numbers and health data.
APRS members were exposed in the November 2025 breach of Itelis, AXA's third-party optical-care platform, after an attacker posed as a partner optician; leaked data included names, dates of birth, social security numbers, optical reimbursement records and vision-correction details.
In November 2025, optical-care platform Itelis was breached via the impersonation of a partner optician, exposing health and identity data of Malakoff Humanis (and AXA) members from optical reimbursement claims processed between 2020 and 2022.
On 12 November 2025, French medical-software publisher Weda disclosed a cyberattack in which compromised practitioner credentials (stolen by infostealer malware) gave attackers unauthorized access to its patient-record platform, potentially exposing sensitive medical data for tens of thousands of healthcare professionals.
A September 2025 cyberattack on regional health-identity platforms used by several French Regional Health Agencies (ARS) exposed patient identity data; an attacker claimed roughly 35 million patient records across 130+ public hospitals, later offered for sale by the DumpSec group.
On 19 October 2025, the Centre Hospitalier Intercommunal de Haute-Comtรฉ in Pontarlier (France) was hit by a Cryptolocker ransomware attack that encrypted part of its data, forcing a full IT shutdown and a return to paper-based care; attackers demanded a 5 million euro ransom.
A cyberattack on the shared regional health platform (Prรฉdice/GIP Inรฉa) hosting patient identity data from public hospitals in Hauts-de-France exposed records such as names, dates and places of birth, contact details and, in some cases, social security numbers; medical records were not affected.
On 23 September 2025, French medical-lab group Inovie Labosud disclosed a breach exposing administrative and medical data of an estimated 3.2 million patients after attackers used a third-party provider's stolen credentials.
In early August 2025, French optician chain Optic 2000 was hit by a cyberattack โ confirmed on 30 July 2025 and affecting four stores around Paris โ that exposed customer records including names, social security numbers, dates of birth, postal addresses, phone numbers and optician details.
In July 2025, the sexual healthcare product maker Hello Cake suffered a data breach. The data was subsequently posted on a public hacking forum and included 23k unique email addresses along with names, phone numbers, physical addresses, dates of birth and purchases.
A cyberattack on Hรดpital privรฉ de la Loire (Ramsay Santรฉ) in Saint-รtienne, France exposed personal data of up to 530,000 patients, including identity details, social-security numbers (NIR), ID documents and consultation records, after a hacker used stolen physician credentials.
In June 2025, the Indian CME platform Omnicuris suffered a data breach that exposed approximately 200k records of healthcare professionals. The data included names, email addresses, phone numbers, geographic locations and other data attributes relating to professional expertise and trainingโฆ
Patient data managed by Pulsy, the regional e-health operator (GRADeS) for France's Grand Est region, was reported leaked on 13 May 2025, exposing identity details, contacts and sensitive health information including care pathways and hospitalisation records.
In late March 2025, French medical-laboratory network Cerballiance disclosed a data breach traced to a February intrusion on an IT provider's server, exposing administrative and some health data of patients in the PACA region, including names, social security numbers and certain test reports.
Suspicious network activity at Yale New Haven Health led to the largest U.S. healthcare data breach of 2025: 5.5 million patients had names, contact details, dates of birth, medical record numbers, and Social Security numbers stolen. The health system later agreed to an $18 million class-action settlement.
On 27 January 2025, French HIV/hepatitis-prevention charity AIDES disclosed a breach of a secured file-sharing server, exposing supporters' identity, contact and banking details (IBAN) and, for some, health-related information.
On 19 Nov 2024 a threat actor put the records of ~758,912 patients of French healthcare provider Alรฉo Santรฉ โ extracted via a compromised privileged account on the Mediboard patient-record platform โ up for sale on BreachForums, exposing identities, contact details and sensitive medical data.
A hacker using the alias xenZen exposed personal and medical data on 31.2 million Star Health customers via Telegram bots, alongside 5.76 million claims records. The leak escalated into a public extortion drama implicating a senior Star Health official.
A ransomware attack on Australian e-prescription provider MediSecure exposed the personal and health data of roughly 12.9 million Australians โ one of the country's largest breaches โ and pushed the company into administration and liquidation.
Black Basta ransomware crippled Ascension, one of the largest U.S. health systems, after an employee downloaded a malicious file. The attack forced 140 hospitals onto manual operations for weeks, diverted ambulances, and ultimately exposed the data of nearly 5.6 million patients.
In April 2024, 2.1M email addresses from the online health products store Piping Rock were publicly posted to a popular hacking forum. The data also included names, phone numbers and physical addresses.
ALPHV/BlackCat compromised Change Healthcare via Citrix portal lacking MFA, paralyzed U.S. prescription claims for weeks, and exfiltrated data on an estimated 100 million people.
A Backmydata (Phobos-family) ransomware attack on the shared Hipocrate hospital information system encrypted data at 25 Romanian hospitals and forced about 75 more offline, pushing more than 100 facilities back to paper records.
In early February 2024, French third-party health-payment operators Viamedis and Almerys disclosed breaches exposing data on about 33 million people โ names, dates of birth, social security numbers and health-insurer details โ in one of France's largest ever data breaches.
The RA World ransomware gang breached Poland's nationwide ALAB Laboratoria medical-lab network, stealing patient test results and PESEL identity numbers. ALAB refused to pay, and the criminals published sensitive medical data on tens of thousands of patients in what became Poland's largest medical data breach.
Attackers used credentials reused from prior breaches to access 23andMe accounts, then leveraged the 'DNA Relatives' feature to scrape ancestry and genetic profile data on 6.9 million users from compromised relatives' connections.
The Medusa ransomware gang breached the Philippine Health Insurance Corporation, exfiltrating around 750 GB of sensitive member and medical data and demanding a $300,000 ransom; the government refused to pay and the data was leaked.
In March 2023, DC Health Link discovered a data breach that was later publicly posted to a popular data breach forum. The impacted data included 48k unique email addresses alongside names, genders, dates of birth, home addresses, phone numbers and social security numbers.and "IntelBroker".
Toronto's Hospital for Sick Children was hit by a ransomware attack over the December 2022 holidays that delayed lab and imaging results; in a rare move, the LockBit gang apologized, blamed a rogue affiliate, and released a free decryptor.
The RansomHouse gang struck Colombian healthcare giant Keralty and its EPS Sanitas and Colsanitas subsidiaries, claiming 3 TB of stolen data and crippling appointment scheduling for a network serving more than 6 million patients.
Ransomware encrypted the All India Institute of Medical Sciences in New Delhi โ India's most prestigious public hospital โ taking patient registration and clinical records offline for two weeks during peak winter patient load.
In June 2023, the Tacoma-Pierce County Health Department announced a data breach of their Washington State Food Worker Card online training system. The breach was published to a popular hacking forum the year before and dated back to a 2018 database backup.
Russian-speaking attackers exfiltrated full health-claim records on 9.7 million current and former Medibank customers, then released them in tranches on the dark web after the Australian insurer refused to pay.
A LockBit 3.0 ransomware attack on NHS software supplier Advanced took down the NHS 111 triage service and forced clinicians back to pen and paper, exposing data on tens of thousands of patients and drawing a ยฃ3.07 million ICO fine.
The Hive ransomware group crippled Costa Rica's national public-health insurer, the CCSS, encrypting more than 800 servers, forcing hospitals back to paper, and cancelling tens of thousands of medical appointments.
A database from Russian medical-testing chain Gemotest was offered on a hacking forum, with sellers claiming data on 31 million clients โ names, passport and insurance numbers, dates of birth, addresses, phone numbers and email addresses. Have I Been Pwned later indexed about 6.3 million unique email addresses from the leak.
A Hive ransomware attack on Newfoundland and Labrador's health-care network crippled IT systems across the province, forcing the cancellation of thousands of appointments and procedures in what officials called the worst cyberattack in Canadian history.
In October 2021, the Israeli hosting provider CyberServe was breached and ransomed before having a substantial amount of their customer data leaked publicly by a group known as "Black Shadow". Amongst the data was the LGBTQ dating site Atraf and the Machon Mor medical institute.
DeepBlueMagic ransomware paralysed Israel's Hillel Yaffe Medical Center, locking every hospital computer system. As a government-owned hospital barred from paying ransom, it ran on paper and alternative systems for weeks, taking roughly two months to fully recover.
The AvosLocker ransomware gang attacked the Dubai branch of NHS-affiliated Moorfields Eye Hospital, exfiltrating roughly 60 GB of patient and staff data including ID cards, insurance claims and internal records, then dumping it online.
A RansomEXX ransomware attack encrypted the datacenter of Italy's Lazio Region, knocking the COVID-19 vaccination booking portal offline for days and triggering a domestic terrorism investigation.
In May 2022, the client management system for the Australian government's NDIS (National Disability Insurance Scheme) suffered a data breach which was subsequently posted to an online hacking forum.
Personal data on an estimated 279 million Indonesians โ more than the country's living population โ was scraped from the national health-insurance agency BPJS Kesehatan and offered for sale on the RaidForums hacking forum.
A Zeppelin ransomware attack crippled New Zealand's Waikato District Health Board, taking down clinical systems and phone lines across five hospitals for weeks, postponing surgeries, and leaking patient and staff data on the dark web.
Conti ransomware paralysed Ireland's Health Service Executive, forcing cancellation of outpatient appointments nationwide for weeks. Conti released the decryptor for free; recovery still cost an estimated โฌ100M+.
Conti operators tricked an HSE user into downloading a booby-trapped Excel attachment; the resulting ransomware forced the Health Service Executive to shut down all of Ireland's healthcare IT systems and exfiltrated 700 GB including COVID-19 vaccination PHI. Recovery cost exceeded โฌ100 million.
In January 2021, over 11M unique email addresses were discovered by Night Lion Security alongside an extensive amount of personal information including names, physical and IP addresses, phone numbers and dates of birth.
Insiders at the Dutch municipal health service GGD stole personal data โ including BSN national ID numbers โ from the CoronIT and HPzone COVID-19 systems and sold it on Telegram, Snapchat and Wickr for โฌ30-โฌ60 per person.
In December 2020, the dental practice management service MMG Fusion was the victim of a data breach which exposed 2.6M unique email addresses. The data also included patient appointments, names, phone numbers, dates of birth, genders and physical addresses.
Records on approximately 33,000 patients of Finnish psychotherapy provider Vastaamo were stolen in 2018 from an unencrypted database with no root password. After failed company-extortion in October 2020, the attacker sent ransom demands to ~30,000 patients directly. Founder later acquitted; Aleksanteri Kivimรคki convicted and sentenced to 6 years 3 months.
A ransomware attack forced Brno University Hospital โ one of Czechia's largest hospitals and a major COVID-19 testing centre โ to shut down its entire IT network, cancel surgeries, and divert acute patients at the height of the early pandemic.
Canada's largest medical-testing laboratory disclosed that attackers had accessed health data on roughly 15 million customers, paid an undisclosed ransom to retrieve the stolen records, and was later found by privacy regulators to have failed to safeguard the information.
An EmotetโTrickBotโRyuk malware chain crippled the Rudolf and Stefanie Hospital in Beneลกov, Czech Republic, knocking out X-ray, ultrasound, and laboratory systems and paralysing the facility for weeks. The hospital did not pay the ransom and reported no patient-record loss.
A ransomware-style cyber incident forced Danish hearing-aid giant Demant to shut down IT systems worldwide, crippling production and order processing and causing an estimated loss of up to $95 million โ one of the costliest single ransomware events on record.
In August 2019, a data breach from the Spanish online pharmacy Promofarma appeared for sale on a dark web marketplace. The breach exposed over 2.7M records and contained almost 1.3M unique customer email addresses. The data also included customer names and was provided to HIBP by dehashed.com.
In October 2020, the Finnish psychotherapy service Vastaamo was the subject of a ransomware attack targeting first the company itself, followed by their patients directly.
Confidential records of 14,200 HIV-positive people from Singapore's national HIV registry were stolen and leaked online by a foreigner who obtained them through his partner, a Ministry of Health doctor with privileged access.
Chinese state-attributed actors exfiltrated personal and outpatient medication records on 1.5 million SingHealth patients โ including Prime Minister Lee Hsien Loong โ in Singapore's most serious cyber incident.
In July 2018, the health and fitness service 8fit suffered a data breach. The data subsequently appeared for sale on a dark web marketplace in February 2019 and included over 15M unique email addresses alongside names, genders, IP addresses and passwords stored as bcrypt hashes.
A destructive wiper disguised as ransomware, propagated via a compromised Ukrainian accounting software update. Estimated $10 billion in global damage โ the most economically destructive cyberattack in history.
A North Korean ransomware worm that exploited the EternalBlue SMB vulnerability to spread to ~200,000 systems across 150 countries in 24 hours. Paralysed the U.K.'s NHS and crippled manufacturing globally.
In March 2017, the telemarketing service Health Now Networks left a database containing hundreds of thousands of medical records exposed. There were over 900,000 records in total containing significant volumes of personal information including names, dates of birth, various medical conditions andโฆ
In approximately February 2015, the home financing website MyFHA suffered a data breach which disclosed the personal information of nearly 1 million people.
Chinese state-attributed actors exfiltrated personal data on 78.8 million current and former Anthem health insurance customers โ at the time the largest healthcare-sector breach in U.S. history.