Undisclosed Minnesota MyChart user
July 1, 2026
•[ phishing, healthcare, financial ]
A Minnesota MyChart user reported to the Federal Trade Commission that a phishing email impersonating MyChart offered a free Medicare Kit in exchange for completing a survey and paying shipping. The victim, who identified Welia Health in Mora as the provider through which they used MyChart, completed the survey, entered credit-card and personal information, and submitted the form. Minutes later, the victim observed a card transaction categorized as an unrelated animal/pet service. Later reporting based on FTC complaints confirmed multiple successful victims of the same broader MyChart impersonation campaign. Epic and Welia Health were not themselves breached.
Undisclosed Illinois MyChart user
July 1, 2026
•[ phishing, healthcare, financial ]
An Illinois MyChart user reported to the Federal Trade Commission that a phishing email impersonating MyChart offered a free Medicare Kit and directed the victim through a survey to a shipping-payment step. The victim submitted Mastercard information before recognizing the message as fraudulent and reported that the scammers had obtained the card information. The complaint is one of several successful victims documented in the broader coordinated MyChart impersonation campaign. MyChart and Epic were not themselves breached.
Golden State Orthopedics & Spine
July 1, 2026
•[ ransomware, healthcare ]
Walnut Creek, California practice Golden State Orthopedics & Spine detected unusual network activity around July 2, 2026, saying patient data incl. SSNs may have been accessed. Brain Cipher claimed the attack on July 1, alleging 150 GB stolen; ~125,000 records were later indexed.
Northeast Pediatrics & Adolescent Medicine
July 2, 2026
•[ ransomware, healthcare, leak ]
On July 2, 2026, Anubis added Northeast Pediatrics & Adolescent Medicine to its extortion site and claimed that employee and patient data had been stolen. The precise intrusion date and initial-access method were not disclosed. After reported communications between the practice and Anubis ended, data was published, and the supplied breach database indexed 29,356 records containing names, dates of birth, phone numbers, and street addresses. No operational disruption or successful encryption was publicly confirmed.
Cook Medical LLC
July 2, 2026
•[ social, leak, healthcare ]
On July 2, 2026, a Cook Medical employee was deceived through social engineering and gave an outside party access to company systems. Cook identified and contained the access the same day. The company confirmed customer business-contact information, Salesforce communications, employee names and email addresses, and certain SharePoint business files were accessed, while stating that products, manufacturing, and patient/customer services were unaffected. ShinyHunters later claimed the incident and said it obtained more than 182 GB of data after failed extortion negotiations.
Olpha
July 3, 2026
•[ hack, healthcare, technology ]
During investigation of the LVM incident, CERT.LV determined that the same attacker, later identified as Bytetobreach, independently compromised at least one server belonging to Latvian pharmaceutical manufacturer Olpha. Unauthorized access and deletion of evidentiary log files were confirmed; the server was contained, its data was not encrypted, and Olpha had identified no additional damage as of July 3, 2026.
Abbott Laboratories, Inc. (Core Laboratory Diagnostics)
July 4, 2026
•[ leak, healthcare, technology ]
On July 4, 2026, ShadowByt3$ claimed to have used compromised customer credentials and a weakness in Abbott's externally facing, third-party-hosted LabCentral portal to query API endpoints and download files. Abbott treated this as a separate incident, said the portal contained only public product-reference material, and reported no known exposure of proprietary, sensitive customer, or business information and no operational impact. The attacker's broader claims about regulatory and technical files remain unverified.
Clover Health Investments, Corp.
July 4, 2026
•[ social, healthcare, financial ]
Clover Health detected anomalous login activity on July 4, 2026 and determined that an unidentified actor used social engineering to trick three non-managerial health-plan employees into disclosing credentials, enabling access to their employee email accounts used for member visit scheduling and broker-facing sales. The accounts could access member personal and protected health information but not corporate financial or claims systems. Clover contained and terminated the access, and no operational disruption was reported. No group, country, extortion demand, or stated motive was identified; Criminal and Financial are bounded inferences from deliberate credential theft targeting accounts containing identity and health data. Clover is remote-first and states that it maintains no headquarters, so state and county remain undetermined.
CorePharma LLC
July 8, 2026
•[ leak, healthcare, manufacturing ]
Chaos listed CorePharma on 8 July and claimed it had breached the pharmaceutical manufacturer's internal network and stolen a comprehensive archive of regulatory, manufacturing-compliance, and operational information. A searchable dataset contains 14,342 contact records. CorePharma has not publicly confirmed the incident, and the access method, total volume, ransom demand, and precise contents remain undisclosed. No encryption or operational disruption was reported.
Beaver County Behavioral Health
July 8, 2026
•[ ransomware, healthcare, government ]
Beaver County Behavioral Health, a Pennsylvania county agency, was hit by ransomware from July 8, 2026 that locked staff out of systems and patient files. Hackers copied patient PHI incl. SSNs and diagnoses; the county reportedly paid a ransom and notified patients Sept. 4.
The Hospital for Sick Children (SickKids)
July 9, 2026
•[ hack, healthcare ]
SickKids identified a cybersecurity incident on July 9, 2026 involving a vulnerability in a third-party software application supporting its external Careers website and certain human-resources functions. The incident resulted in unauthorized access to employee and job-applicant personal information and temporarily affected the Careers website. Clinical systems, patient information and patient care were unaffected.
Craneware plc
July 20, 2026
•[ leak, technology, healthcare ]
Craneware disclosed on July 20, 2026 that an unauthorized party had accessed a subset of its internal data environment and removed employee, customer, and partner records. Chaos claimed responsibility on July 28 and alleged theft of approximately 960 gigabytes, but Craneware has not confirmed the attribution or the actor's claim. Craneware explicitly said neither its operations nor customer services were disrupted.
North Dakota Department of Health and Human Services
July 21, 2026
•[ phishing, leak, healthcare ]
North Dakota HHS said a phishing email on 21 Jul 2026 let an unauthorized third party into the email accounts of three Developmental Disabilities staff, exposing health data of about 1,700 clients. State IT secured the accounts; notices went out 24 Aug.
AnMed
July 26, 2026
•[ ransomware, malware, healthcare ]
On July 26, 2026 AnMed detected malware that locked access to computer-network files and disrupted telephone, internet, medical-office and clinical IT services, causing multiple temporary facility closures. Files stored on certain local systems were also copied without authorization in July; AnMed later confirmed the theft but said its cloud-based electronic health records were not affected. On August 11 attackers claiming to be The Gentlemen posted ransom demands through AnMed social-media accounts and claimed theft of 6 TB; AnMed did not verify the volume. Care and communications services were progressively restored and an investigation to identify affected individuals continued.
George House Trust
July 27, 2026
•[ hack, misconfiguration, healthcare ]
George House Trust was affected by the broader Beacon CRM breach. Beacon's investigation determined that an unauthorized criminal actor used a compromised AWS access key to access its systems beginning at approximately 01:20 UTC on July 27 for about 1 hour and 27 minutes and likely downloaded the customer database, including attachments, in readable form. George House Trust confirmed that information relating to its service users was contained in the affected database. Beacon found no evidence that the information was published, sold, or otherwise misused and received no ransom demand. The actor later contacted Beacon claiming the copied data would be deleted and not retained, sold, or shared. The actor's identity and motive remain undetermined.
Undisclosed South Korean healthcare website owner or operator
July 30, 2026
•[ espionage, healthcare, government ]
An unnamed state-sponsored group compromised at least one South Korean healthcare website and used it as a watering hole against selected visitors. Fifteen legitimate South Korean websites across several sectors were used as watering holes, but the exact number in the healthcare sector, individual compromise dates, and specific server-access method were not disclosed. No operational disruption or data theft from the website owner was reported.
Updoc
July 31, 2026
•[ leak, healthcare, technology ]
Updoc detected a brief period of unauthorized access on July 31, 2026 to a third-party system used to support its operations. Contact information belonging to some account holders may have been accessed, including names, email addresses, and postal addresses. Updoc stated that its own systems were not accessed, immediately blocked the unauthorized access, and found no evidence of further unauthorized activity.
Lumenis Ltd.
August 1, 2026
•[ hack, leak, healthcare ]
ShinyHunters claimed it compromised Lumenis and obtained more than 1.1 million customer and employee records along with more than 176GB of internal corporate data, threatening publication unless the company engaged by August 4. DataBreach.com subsequently indexed 592,328 leaked rows. The larger attacker-claimed figures have not been independently confirmed, and no operational disruption has been established.
Undisclosed Indiana MyChart user
August 1, 2026
•[ phishing, financial, healthcare ]
An Indiana MyChart user reported to the Federal Trade Commission that a phishing email impersonating MyChart offered a free Medicare first-aid kit in exchange for completing a survey and paying $9.95 shipping. After the victim submitted payment information, the card was charged $9.95 and then immediately charged another $29.95 by a separate scam company. The complaint confirms successful acquisition and fraudulent use of payment data within the broader coordinated MyChart impersonation campaign. MyChart and Epic were not themselves breached.
Novocure
August 1, 2026
•[ leak, healthcare, technology ]
Novocure, a cancer treatment device maker, said on 1 Sep 2026 that unauthorized access to some systems in mid-August exposed internal IDs of 1,400+ U.S. patients plus provider and employee contacts. ShinyHunters reportedly leaked a 33GB archive. Systems stayed functional.
