Centers for Medicare & Medicaid Services
January 1, 2018
•[ hack, healthcare ]
hacked
NHS Dumfries and Galloway
January 1, 2024
•[ hack, healthcare ]
cyber attack
City and Hackney Teaching Primary Care Trust
January 1, 2007
•[ leak, healthcare ]
lost / stolen media
Chris Leong
August 10, 2024
•[ hack, malware, healthcare ]
In August 2024, the website of Master Chris Leong "a leading Tit Tar practitioner in Malaysia" suffered a data breach. The incident exposed 27k unique email addresses along with names, physical addresses, dates of birth, genders, nationalities and in many cases, links to Facebook profiles. The company did not respond when contacted about the breach.
MMG Fusion
December 20, 2020
•[ leak, misconfiguration, healthcare ]
In December 2020, the dental practice management service MMG Fusion was the victim of a data breach which exposed 2.6M unique email addresses. The data also included patient appointments, names, phone numbers, dates of birth, genders and physical addresses. A small number of records also included passwords stored as bcrypt hashes.
Health Now Networks
March 25, 2017
•[ leak, misconfiguration, healthcare ]
In March 2017, the telemarketing service Health Now Networks left a database containing hundreds of thousands of medical records exposed. There were over 900,000 records in total containing significant volumes of personal information including names, dates of birth, various medical conditions and operator notes on the individuals' health. The data included over 320k unique email addresses.
diet.com
August 10, 2014
•[ leak, misconfiguration, healthcare ]
In August 2014, the diet and nutrition website diet.com suffered a data breach resulting in the exposure of 1.4 million unique user records dating back as far as 2004. The data contained email and IP addresses, usernames, plain text passwords and dietary information about the site members including eating habits, BMI and birth date. The site was previously reported as compromised on the Vigilante.pw breached database directory.
Acne.org
November 25, 2014
•[ leak, healthcare ]
In November 2014, the acne website acne.org suffered a data breach that exposed over 430k forum members' accounts. The data was being actively traded on underground forums and included email addresses, birth dates and passwords.
V-Tight Gel
February 13, 2016
•[ leak, healthcare ]
In approximately February 2016, data surfaced which was allegedly obtained from V-Tight Gel (vaginal tightening gel). Whilst the data set was titled V-Tight, within there were 50 other (predominantly wellness-related) domain names, most owned by the same entity. Multiple HIBP subscribers confirmed that although they couldn't recall providing data specifically to V-Tight, their personal information including name, phone and physical address was accurate. V-Tight Gel did not reply to multiple requests for comment.
CTARS
May 21, 2021
•[ leak, hack, misconfiguration ]
In May 2022, the client management system for the Australian government's NDIS (National Disability Insurance Scheme) suffered a data breach which was subsequently posted to an online hacking forum. The CTARS cloud platform is used by care providers to record information about NDIS participants and often contains sensitive medical information. Impacted data includes over 12k unique email addresses, physical addresses, names, dates of birth, phone numbers and data related to patient conditions and treatments.
8fit
July 1, 2018
•[ leak, healthcare ]
In July 2018, the health and fitness service 8fit suffered a data breach. The data subsequently appeared for sale on a dark web marketplace in February 2019 and included over 15M unique email addresses alongside names, genders, IP addresses and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.
Vastaamo
March 31, 2019
•[ ransomware, malware, healthcare ]
In October 2020, the Finnish psychotherapy service Vastaamo was the subject of a ransomware attack targeting first the company itself, followed by their patients directly. The original security incident dates back to a period between late 2018 and early 2019 and exposed data including 30k unique email addresses, names, social security numbers and notes on individuals' psychotherapy sessions. This breach has been flagged as "sensitive" and is only searchable by owners of the email addresses and domains exposed in the incident.
Guardian Healthcare
November 8, 2024
•[ ransomware, malware, healthcare ]
Guardian Healthcare is the victim of a Stormous ransomware attack. The threat actors leaked 3 GB of files, many of which contain protected health information (PHI) of patients.
Rocky Mountain Gastroenterology
February 22, 2024
•[ ransomware, malware, healthcare ]
Rocky Mountain Gastroenterology suffers a triple ransomware attack.
OnePoint Patient Care
August 8, 2024
•[ ransomware, malware, healthcare ]
OnePoint Patient Care (OPPC) informs customers about a data breach impacting their personal information. The Inc Ransom ransomware group takes credit for the attack. The impact is bigger than initially believed, with over 1.7 million people affected
Summit Pathology and Summit Pathology Laboratories
April 18, 2024
•[ ransomware, healthcare ]
Summit Pathology and Summit Pathology Laboratories (Summit) in Colorado notify of a breach affecting 1,813,538 patients. The Medusa ransomware gang is allegedly responsible for the breach.
American Heart of Poland
November 28, 2024
•[ hack, healthcare ]
American Heart of Poland receives a fine of 330,000, after suffering a hacking incident.
Mystic Valley Elder Services
October 5, 2024
•[ leak, healthcare ]
Mystic Valley Elder Services suffers a data breach impacting many individuals.
Great Plains Regional Medical Center
September 8, 2024
•[ ransomware, malware, healthcare ]
Great Plains Regional Medical Center in Oklahoma notifies over 133,000 individuals that their personal information was compromised in a ransomware attack.
