Ampath Laboratories confirms cyberattack, disputes claim of 80 million stolen records
South African pathology group Ampath confirmed a cyber incident and disputed a threat actor's claim to have stolen 80 million records.
- Victim
- Ampath Laboratories
Incidents in sector:
Healthcare
Astrana Health tells SEC a vishing attack exposed sensitive data
Astrana Health disclosed in an SEC filing that attackers used phone-based social engineering, spoofing its corporate number and impersonating staff, to access confidential data on its servers.
- Victim
- Astrana Health
Veradigm discloses patient data breach after The Gentlemen ransomware gang claims attack
Healthcare technology firm Veradigm disclosed that attackers used credentials stolen from a third-party vendor to reach a customer-service API and copy patient data, after The Gentlemen ransomware gang claimed to hold roughly 3.5 million records.
- Victim
- Veradigm
- Records
- 3.5M
Aesto Health AWS environment breach (9.5 million patients)
Healthcare data migration and archiving vendor Aesto Health reported that an intruder accessed part of its Amazon Web Services environment in December 2025, exposing the medical and identity data of 9,540,683 patients across dozens of provider clients.
- Victim
- Aesto Health
- Records
- 9.5M
Nutex Health confirms data theft in August cyberattack (The Gentlemen)
U.S. hospital and healthcare-facilities operator Nutex Health confirmed in an SEC filing that patient, employee, provider and financial information was accessed and exfiltrated in an August cyberattack claimed by the ransomware-as-a-service group The Gentlemen.
- Victim
- Nutex Health Inc.
McKesson third-party application breach (ShinyHunters extortion)
Pharmaceutical distribution giant McKesson disclosed a cybersecurity incident involving unauthorized access to third-party applications and the exfiltration of data belonging to a subset of customers in its Oncology & Multispecialty and Medical-Surgical business units.
- Victim
- McKesson Corporation
Baylor Genetics data breach exposes 2.8 million people
Houston-based genetic-testing company Baylor Genetics disclosed a data breach affecting about 2.8 million people after an unauthorized party accessed portions of its network and exfiltrated sensitive health and personal information.
- Victim
- Baylor Genetics
- Records
- 2.8M
Boston Scientific network outage disrupts order and shipping systems
Medical-device maker Boston Scientific disclosed a cybersecurity incident that caused a network outage and disrupted company operations, including the systems used to process and ship customer orders for its cardiac and interventional devices.
- Victim
- Boston Scientific Corporation
National Kidney Registry listed by DireWolf ransomware group
The DireWolf extortion group claimed to have stolen roughly 253 GB of highly sensitive data — including donor and transplant-recipient medical records — from the National Kidney Registry, a U.S. nonprofit that facilitates living-donor kidney transplants.
- Victim
- National Kidney Registry
SickKids employee data breach (third-party software flaw)
Toronto's Hospital for Sick Children (SickKids) disclosed that a vulnerability in a third-party software application exposed personal information of current and former employees and job applicants, while clinical systems and patient data were unaffected.
- Victim
- The Hospital for Sick Children (SickKids)
Alphanumeric Systems ransomware breach (Settra)
Alphanumeric Systems, a US managed-service and technology provider to the healthcare and life-sciences industries, was listed by the Settra ransomware group, which claimed to have exfiltrated roughly 161 gigabytes of data including employee and health-related information.
- Victim
- Alphanumeric Systems, Inc.
Baxter International data breach (ShinyHunters)
After Baxter International declined to meet an extortion deadline, the ShinyHunters group published a data set it said contained 7.1 million records stolen from the medical-device maker's Salesforce environment through a third-party application compromise.
- Victim
- Baxter International Inc.
- Records
- 7.1M
MyDr medical records platform breach exposes data on nearly 19 million Poles
Poland's Ministry of Digital Affairs confirmed that attackers stole more than 2 TB of patient data from MyDr, a medical documentation platform used by about 12,000 facilities, affecting nearly half the country's population.
- Victim
- MyDr
Ransomware disrupts doors, HVAC monitoring and ID cards at Winnipeg's Health Sciences Centre
Shared Health confirmed a ransomware incident at Manitoba's largest hospital that hit facility maintenance systems, including central HVAC monitoring, door access controls and staff ID card issuance, while patient care continued.
- Victim
- Health Sciences Centre Winnipeg (Shared Health Manitoba)
GENESIS ransomware lists Interim HealthCare of Oklahoma, claims 1TB stolen (2026)
The GENESIS ransomware group listed Interim HealthCare's Oklahoma City and Tulsa operations on its leak site on 10 August 2026, claiming to have exfiltrated about a terabyte of patient and company data.
- Victim
- Interim HealthCare of Oklahoma City
Unlimited Technology Systems data center breach exposes 3.8 million patients
Ohio-based healthcare revenue-cycle technology provider Unlimited Technology Systems reported to HHS that hackers stole personal and medical data on 3,803,750 people from one of its commercial data centers in October 2025.
- Victim
- Unlimited Technology Systems
Baylor Genetics data breach exposes health data of 2.8 million patients (2026)
Genetic-testing firm Baylor Genetics disclosed in late July 2026 that an intrusion into its network had exposed the protected health information of more than 2.8 million patients.
- Victim
- Baylor Genetics
- Records
- 2.8M
Amgen discloses material cloud data breach exposing patient and proprietary data (2026)
Biotech giant Amgen disclosed in a July 2026 SEC filing a material cybersecurity incident in which attackers exfiltrated patient health information and proprietary data from third-party cloud environments.
- Victim
- Amgen
MCBS medical billing breach exposes 1.26 million patients (PEAR extortion)
Medical Computer Business Services (MCBS), a Georgia billing and software vendor for healthcare providers, disclosed that a September 2025 network intrusion exposed Social Security numbers and medical information of 1,261,464 people.
- Victim
- Medical Computer Business Services (MCBS)
Ransomware attack forces South Carolina health system AnMed to close dozens of facilities (2026)
AnMed, a nonprofit health system in upstate South Carolina, said a malware attack forced it to close more than 80 facilities, with the ransomware group The Gentlemen linked to the incident.
- Victim
- AnMed
Health-tech firm Craneware says customer, employee and partner data stolen in cyberattack
Edinburgh-based healthcare billing software maker Craneware disclosed that attackers gained unauthorised access to part of its data environment and exfiltrated a significant volume of employee, customer and partner records before being expelled.
- Victim
- Craneware
Abbott investigates ShinyHunters extortion claim over breach of legacy Exact Sciences cancer-diagnostics systems
Abbott confirmed attackers gained access to a limited number of legacy Exact Sciences systems in its Cancer Diagnostics business after the ShinyHunters extortion group listed it on a leak site.
- Victim
- Abbott Laboratories
AdaptHealth reports material breach of patient data after social-engineering attack
Home medical equipment provider AdaptHealth disclosed a material cybersecurity incident in which a social-engineering attack on a third-party contractor let a threat actor into its cloud systems and reach patient personal and health information.
- Victim
- AdaptHealth
Medtronic notifies 3.8 million people of ShinyHunters data breach
Medical device maker Medtronic began notifying roughly 3.8 million people that their personal data was exposed when the ShinyHunters extortion group accessed its corporate IT systems in April 2026.
- Victim
- Medtronic
More incidents (113)
- TriWest Healthcare Alliance breach exposes TRICARE West military beneficiaries' personal data
- Phishing breach at healthtech firm Xsolis exposes 1.4 million people
- Cherry Health discloses data breach after suspected ransomware outage
- One Medical Seniors legacy records breach (ShinyHunters extortion claim)
- UNC6508 PRC-nexus medical & defense research espionage campaign
- Novo Nordisk discloses breach of clinical-trial patient data after IT security incident
- iRhythm third-party application breach and extortion demand
- DentaQuest ShinyHunters data breach exposes 2.6 million accounts (2026)
- Almerys at the heart of a massive leak of 15 million social security numbers
- NYC Health + Hospitals vendor breach exposes medical and biometric data of 1.8 million people
- CalendrIDEL: data of 1,400 self-employed nurses publicly disclosed
- Clinique Ambroise Paré Beuvry: also a victim of a cyberattack
- Cyberattack on Moldova's National Health Insurance Company may have exposed a third of its database
- UK Biobank data on 500,000 volunteers listed for sale on Alibaba
- Sterimed: internal files published after a cyberattack
- Clinique de l'Yvette: a leak of medical imaging claimed
- ChipSoft ransomware attack disrupts Dutch hospital software supplier
- Ransomware attack on Signature Healthcare forces Brockton Hospital to divert ambulances
- YMED (SOONCARE): 253,000 patients exposed, 132 GB of medical data exfiltrated
- ARS: 35 million patients affected by a data leak, 130 hospitals and AP-HP targeted
- Nosho: 133,000 users compromised, a new leak that weakens the medical sector
- Hong Kong Hospital Authority leak exposes data of 56,000 patients via contractor
- CareCloud AWS environment breach exposes 3.7 million patients' records
- Cerballiance: medical data exposed after a cyberattack
- 113,000 members affected by a cyberattack at La Mutuelle Familiale
- 890,000 users affected by a claimed leak at GPS Santé
- 71,502 patients affected by a claimed data leak at Therapeutes.com
- 813,866 users affected by the data leak at Medoucine
- Stryker Handala wiper attack (Iran-linked, 2026)
- 4,600 people affected by a claimed leak at Ordoclic
- 12,711 coordinators affected by a claimed data leak at CetteFamille
- Leak at ADMR
- 15,108 employees hit by claimed leak at ARS
- 7,665 patients affected by a claimed data leak at Asten Santé
- 4,000 officers affected by a claimed data leak at Centre National de Gestion (CNG)
- 23,535 locum doctors - claimed data leak at Médecins Remplaçants
- Association Nationale des Premiers Secours data breach (2026)
- Leak at Puteaux Medical Imaging Centre
- 900,000 Lyleoo users affected by a data leak
- Leak at monlogicielmedical.com
- 146,605 patients affected by a claimed leak at SOS Oxygène
- 1,050 identities exposed in the data leak at Petits-fils
- 24,000 trainees affected by a claimed data leak at AFPPCD-IDF
- Leak at Résidence du Parc (Champdeniers-Saint-Denis)
- Leak at Médecin Direct
- Leak at MSP Givors Presqu'Île (via Weda)
- Leak at Clinique du Millénaire (via Weda)
- Leak at Itelis
- Leak at MSP du Pré Vicinal (via Weda)
- Leak at APRS (via Itelis)
- Leak at Malakoff Humanis (via Itelis)
- Data leak at Weda
- Leak at Regional Health Agencies of Île-de-France, Auvergne, Rhône-Alpes, Hauts-de-France, Pays de la Loire and Normandie
- Leak at Haute-Comté intercommunal hospital centre
- Leak at Agence Régionale de Santé des Hauts-de-France
- Leak at Inovie Labosud
- Leak at Optic 2000
- Hello Cake data breach (2025)
- Leak at Hôpital privé de la Loire
- Omnicuris data breach (2025)
- Leak at Pulsy
- Leak at Cerballiance
- Yale New Haven Health data breach (2025)
- Leak at AIDES
- Conduent ransomware breach confirmed to have exposed data of more than 62 million people
- Leak at Mediboard
- Star Health insurance breach and senior-official extortion (India, 2024)
- MediSecure ransomware attack
- Ascension Health ransomware attack
- Piping Rock data breach (2024)
- Change Healthcare ransomware (ALPHV/BlackCat)
- Romanian hospitals ransomware wave
- Leak at Almerys, Viamedis
- ALAB Laboratoria ransomware data leak
- 23andMe credential-stuffing breach
- PhilHealth Medusa ransomware attack
- DC Health Link data breach (2023)
- SickKids hospital ransomware attack
- Keralty / Sanitas RansomHouse ransomware attack
- AIIMS Delhi ransomware
- Washington State Food Worker Card data breach (2022)
- Medibank ransomware (REvil-affiliated)
- Advanced / NHS 111 ransomware attack
- CCSS Hive ransomware attack
- Gemotest medical laboratory data breach
- Newfoundland and Labrador health-system cyberattack
- CyberServe data breach (2021)
- Hillel Yaffe Medical Center ransomware attack
- Moorfields Eye Hospital Dubai ransomware attack
- Lazio Region ransomware attack
- CTARS data breach (2021)
- BPJS Kesehatan data leak
- Waikato District Health Board ransomware attack
- HSE Ireland ransomware (Conti)
- HSE Ireland Conti ransomware national healthcare shutdown (2021)
- Unverified Data Source data breach (2021)
- GGD COVID-19 health data sale
- MMG Fusion data breach (2020)
- Vastaamo psychotherapy data breach and patient extortion (Finland, 2020)
- Brno University Hospital ransomware attack
- LifeLabs data breach
- Benešov Hospital Ryuk ransomware attack
- Demant ransomware attack
- Promofarma data breach (2019)
- Vastaamo data breach (2019)
- Singapore HIV registry leak
- SingHealth data breach
- 8fit data breach (2018)
- NotPetya destructive wiper
- WannaCry ransomware worm
- Health Now Networks data breach (2017)
- MyFHA data breach (2015)
- Anthem Inc. data breach