JPS Health Network
August 3, 2026
•[ hack, healthcare ]
JPS Health Network identified suspicious activity in its technology environment early August 3 and took network systems offline to isolate and secure the environment. The resulting controlled network downtime disrupted clinical and administrative technology across its 582-bed hospital and more than 25 community clinics, forcing paper-based and manual procedures, delaying pharmacy and registration workflows, postponing elective procedures, and causing temporary ambulance diversion for trauma, stroke, and serious heart attack patients. JPS restored its core electronic health record on August 14 and MyChart and routine operations by August 16. JPS has not publicly confirmed ransomware, malware, data theft, extortion, or a responsible actor. Because the technical mechanism that produced the malicious activity is undisclosed, the disruptive subtype remains undetermined.
Healthcare Highways, Inc.
August 4, 2026
•[ ransomware, leak, healthcare ]
Chaos listed Healthcare Highways on its leak site on August 4, 2026 and threatened to publish a 235 GB cache of company and client records if the company did not make contact. The data was subsequently published and was reported to contain protected health information, health insurance claims, and internal corporate documents. Healthcare Highways has not publicly confirmed the incident or independently verified the reported scope of the data.
MyDr Sp. z o.o.
August 6, 2026
•[ leak, healthcare, technology ]
An unidentified attacker deliberately obtained unauthorized access to MyDr's systems no later than August 6, 2026 after overcoming or bypassing technical security controls. Polish prosecutors confirmed access to patient information stored on MyDr infrastructure, and subsequent forensic findings communicated to healthcare customers determined that an unauthorized third party accessed the environment and copied the contents of a cloud-hosted database containing historical patient information. Authorities said the incident may affect approximately 18.8 million people and more than 12,000 medical facilities. Central Polish e-health services and ongoing healthcare delivery were not disrupted.
Shared Health Manitoba (Health Sciences Centre Winnipeg and CancerCare Manitoba)
August 10, 2026
•[ ransomware, healthcare ]
On August 10, 2026, Shared Health identified a ransomware incident affecting a facility-maintenance network serving Health Sciences Centre Winnipeg and CancerCare Manitoba. Shared Health isolated the affected network; central HVAC monitoring and the system for issuing or changing staff access cards were interrupted, and the HSC security office temporarily closed. HVAC equipment remained operational under local monitoring, existing access cards continued functioning and clinical services continued. Recovery was ongoing August 17. Investigators had not established that personal health or financial information had been accessed; no attacker, encryption of particular files or ransom demand was publicly confirmed. The two affected institutions were reported as part of one network incident.
Quirónsalud
August 10, 2026
•[ ransomware, healthcare ]
Quirnsalud, Spain's largest private hospital group, was claimed by the Direwolf ransomware group on Aug. 10, 2026, which threatened to release sensitive healthcare data; 160,181 records were later indexed by DataBreach.com. Quirnsalud has not commented.
Health Carousel
August 10, 2026
•[ ransomware, healthcare, leak ]
Health Carousel, a Cincinnati-based healthcare staffing firm, was listed on the Direwolf ransomware group's leak site on Aug 10, 2026, which claimed it stole critical business data and threatened a full leak. A 952,222-record dataset was later indexed; no company response.
Newfoundland and Labrador Health Services
August 12, 2026
•[ insider, healthcare ]
A Newfoundland and Labrador Health Services employee accessed a patient's electronic health record without authorization on one occasion. An audit initiated after the patient reported the suspected privacy breach confirmed the access. NL Health Services investigated, contained the breach, notified the affected individual, and took measures intended to prevent recurrence. The privacy commissioner did not disclose the employee's identity, motive, or the date of the unauthorized access.
Sharecare, Inc.
August 13, 2026
•[ leak, technology, healthcare ]
ShinyHunters claimed it obtained more than 3.4 million Salesforce records and more than 28GB of internal Sharecare data after failed extortion negotiations. DataBreach.com subsequently indexed 565,222 leaked rows containing personal and contact information. Sharecare has not publicly confirmed the attacker's claimed scope, and no operational disruption has been established.
Santé publique France
August 13, 2026
•[ hack, leak, government ]
French public health agency Sant publique France said a cyberattack on its brochure-ordering site moncoupon.santepubliquefrance.fr, run by an outside provider, exposed contact data of about 80,000 users. The site went into maintenance, passwords were deleted and CNIL notified.
Cedar County Memorial Hospital
August 14, 2026
•[ ransomware, healthcare ]
Cedar County Memorial Hospital in El Dorado Springs, Missouri, shut down its IT networks on Aug 14, 2026, losing its EHR and patient portal for two weeks and partially diverting trauma patients. The Wallstreet ransomware group claimed the attack and posted files on its leak site.
Koninklijke Philips N.V.
August 18, 2026
•[ ransomware, technology, healthcare ]
Philips identified and contained unauthorized activity affecting a specific enterprise server used to store internal data and isolated the affected server. Philips reported no impact to customer environments. In a September 14 update, Philips said incident-response activities were complete and investigation findings supported closure of the incident, while additional analysis of a subset of downloaded data remained ongoing. Cl0p claimed approximately 13.5 GB of drawings, diagrams, and blueprints.
Mutuelle générale de prévoyance
August 18, 2026
•[ financial, leak, healthcare ]
French mutual insurer Mutuelle gnrale de prvoyance (MGP) confirmed an intrusion via a third-party provider in August 2026; a hacker claim cited about 200,000 people and 133,000 IBANs. MGP could not confirm the scope, began notifying members Aug 17 and filed a complaint.
McKesson Corporation
August 21, 2026
•[ phishing, healthcare, leak ]
McKesson discovered the intrusion on August 25, 2026. ShinyHunters claimed it used voice phishing against employees to compromise Okta single-sign-on accounts and access Salesforce and Snowflake environments, with approximately 1 TB exfiltrated between August 21 and August 25. McKesson confirmed customer-data exfiltration from third-party applications but has not confirmed the claimed access method, volume, record count, or data categories. Company services remained operational.
Interim HealthCare, Inc.
August 21, 2026
•[ ransomware, healthcare, financial ]
Anubis listed Interim HealthCare, Inc., the Sunrise, Florida-based corporate franchisor, on its extortion site in August 2026 and claimed theft of approximately 530 GB of corporate and franchise-related data. The group described the material as including franchisee financial information, internal and external audit records, operational discussions, and day-to-day business memoranda. Samples and stolen material were subsequently published, supporting that data acquisition occurred, although Interim HealthCare has not publicly confirmed the intrusion, its exact date, or the claimed 530 GB total. This appears separate from Genesis's claim involving Oklahoma and Tulsa franchise operations.
Boston Scientific Corporation
August 25, 2026
•[ hack, healthcare, manufacturing ]
Boston Scientific identified unauthorized activity on August 25, 2026 that caused a global network outage affecting certain on-premises and internal-facing systems. Manufacturing, order processing, shipping, and new LATITUDE remote-monitoring activations were disrupted. The company reported no indication of related unauthorized activity after August 25 and fully restored manufacturing, order fulfillment, and shipping on September 9. As of September 15, no credible cybercrime or ransomware group has publicly claimed responsibility and Boston Scientific has not attributed the attack.
Nutex Health Inc.
August 26, 2026
•[ leak, healthcare, financial ]
Nutex Health disclosed that an unauthorized third party accessed and exfiltrated information from company servers. The company publicly disclosed the incident on August 24 but has not published the intrusion date; under the coding guide the SecurityWeek publication date is used because the compromise date remains undetermined. Nutex later confirmed that patient, employee, credentialed-provider, business, and financial information was involved. The Gentlemen claimed the incident on August 31, and Nutex said on September 10 that data purportedly obtained in the event had been published. Nutex reported no material operational impact.
Undisclosed Czech healthcare organization
August 27, 2026
•[ leak, healthcare, financial ]
ComSource detected a data leak from an unnamed Czech healthcare organization on 27 August 2026. DataBastard offered the stolen database for sale for $1,400. The exact initial-access and exfiltration dates were not reported, so event_date uses the first documented detection of the leak.
Luminis Health
September 1, 2026
•[ hack, healthcare ]
Luminis Health (Annapolis, Maryland) was hit on Sept 1, 2026 by what it called an unauthorized criminal actor, taking systems offline at Anne Arundel Medical Center and Doctors Community Medical Center; phones were down over two weeks, MyChart until Sept 29, with ER diversions.
Healing Paper
September 4, 2026
•[ hack, healthcare, technology ]
Healing Paper, the Seoul-based operator of cosmetic-surgery platform Gangnam Unni, said an unidentified attacker abused its consultation-records API on Sept 4, 2026, exposing data of 219,665 users in Korea, Japan and Taiwan. It blocked the route and notified users.
Undisclosed healthcare organization
September 8, 2026
•[ hack, healthcare, technology ]
Google's Mandiant reported that a data extortion group breached an unnamed healthcare organization and stole drug research, corporate data and a proprietary AI model, then threatened to publish it unless paid. Disclosed in GTIG's Q2 2026 AI Threat Tracker.
