Lab Express International, Inc.
May 29, 2026
•[ ransomware, healthcare, technology ]
INC Ransom claimed that it compromised shared infrastructure used by Lab Express International and Garonit Pharmaceutical and obtained approximately 200 GB of internal data. DataBreach.com later indexed 5,506 name records associated with labexpress.com. Public reporting did not establish encryption or operational disruption.
Exact Sciences Corporation (Abbott Cancer Diagnostics)
June 1, 2026
•[ phishing, healthcare, leak ]
In mid-June 2026, ShinyHunters used voice phishing against employees and obtained access to a limited number of legacy Exact Sciences cancer-diagnostics systems. Abbott confirmed that some affected files contained personal information and/or protected health information, but said the incident did not affect operations, products, manufacturing, laboratories, or patients. The attackers later published data, and Have I Been Pwned independently identified 10.9 million unique email addresses in the breach corpus.
At least one PTC Windchill/FlexPLM customer
June 1, 2026
•[ ransomware, technology, finance ]
Ransom-ISAC assesses that Cl0p affiliates likely began exploiting CVE-2026-12569 as a zero-day in early June 2026 against internet-exposed PTC Windchill and FlexPLM systems. Attackers deployed custom JSP webshells capable of credential theft and large-scale data exfiltration. Extortion emails were observed beginning July 20, and Cl0p later named more than 40 alleged victims, including Shell, Philips, Fiserv, Zebra Technologies, Mindray, and others. Victim-specific stolen-data volumes ranged from about 1 GB to several terabytes according to Cl0p, although many individual claims remain unconfirmed.
Undisclosed organizations in education, transportation, healthcare, and finance
June 5, 2026
•[ ransomware, education, finance ]
Microsoft reported that The Gentlemen ransomware had affected organizations in the education, transportation, healthcare, and financial sectors across North America, South America, Europe, Africa, and Asia. The self-propagating Go-based encryptor could spread through Windows networks, encrypt local volumes and network shares, delete shadow copies, and leave ransom notes. Microsoft tracks the ransomware operators as Storm-2697, while affiliates conduct the intrusions. Exact victim identities, attack dates, disruption duration, and affected-system counts were not disclosed.
Access Dental & Orthodontics
June 5, 2026
•[ ransomware, leak, healthcare ]
WorldLeaks listed Access Dental & Orthodontics on its leak site on June 5, 2026 and issued a countdown associated with its extortion claim. DataBreach.com later indexed 322,387 records containing personal and contact information. Access Dental operates a dental-services organization headquartered in Irving, Texas. No independently verified operational disruption has been established.
One Medical Seniors via an undisclosed third-party file storage provider
June 8, 2026
•[ leak, healthcare, technology ]
An unauthorized third party accessed a third-party file storage system containing archived One Medical Seniors patient information between 2026-06-08 and 2026-06-11. One Medical discovered the access on 2026-06-13, revoked access, rotated credentials, and stated that the incident was limited to the storage platform and did not affect other One Medical clinics, services, or its electronic medical record system. ShinyHunters claimed to have stolen 8.8 TB and threatened publication, but One Medical did not publicly attribute the breach or confirm the claimed volume.
State Health Care Accreditation Agency under the Ministry of Health
June 9, 2026
•[ leak, misconfiguration, healthcare ]
Lithuanian authorities disclosed that approximately 62,000 records containing personal information about doctors and other healthcare specialists were acquired from the State Health Care Accreditation Agency in a cyber incident identified on June 9, 2026. Reporting linked the access to a vulnerability in a server-hosted data system. The actor, motive, detailed data fields, and number of unique affected individuals were not disclosed, and authorities said there was no evidence that the incident was coordinated with other contemporaneous Lithuanian breaches.
Hospital Authority
June 10, 2026
•[ insider, healthcare ]
An intern doctor surnamed Lai allegedly used another doctor's credentials at Caritas Medical Centre to access Tuen Mun Hospital patient records through the Hospital Authority's Clinical Management System. The Hospital Authority suspended her system access, reported the matter to police, and later dismissed her after finding violations of patient privacy and professional confidentiality; no irregularities in patient treatment were identified.
Baylor Genetics
June 11, 2026
•[ hack, healthcare ]
Baylor Genetics determined that an unauthorized party accessed part of its network and information stored there between June 11 and June 17, 2026. The company discovered suspicious activity around June 15, completed its review July 30 and announced notifications August 14. Its HHS report identified 2,810,878 potentially affected people. Genetic testing and laboratory operations continued normally. Neither an actor name nor ransom, sale or other financial objective has been substantiated; Criminal is a provisional inference from the deliberate acquisition of sensitive personal records.
Premier Medical Group of the Hudson Valley
June 14, 2026
•[ healthcare, hack ]
Poughkeepsie, N.Y. medical practice Premier Medical Group said a June 2026 cyberattack disrupted some of its IT systems and that an unauthorized party accessed files with patient data on June 14; 282,075 people were reported to HHS. No group has claimed the attack.
AdaptHealth Corp.
June 15, 2026
•[ hack, social, healthcare ]
Attackers used social engineering to compromise a user session associated with a third-party contractor, accessed AdaptHealth cloud applications including patient-management and document-storage systems and external EHR portals, and exfiltrated data. AdaptHealth said the incident was contained and did not materially affect operations or patient services. ShinyHunters later claimed responsibility, but the company did not confirm the attribution.
South Plains Rural Health Services, Inc.
June 17, 2026
•[ ransomware, leak, healthcare ]
PEAR claimed that South Plains Rural Health Services was notified of its intrusion on June 17 and later listed the West Texas healthcare provider on its leak site on July 15. By late August, PEAR had published files it claimed were stolen from SPRHS and alleged that approximately 1.4 TB of patient, employee, and administrative data had been exfiltrated. Independent ransomware trackers corroborate the PEAR victim listing and leak-site activity, but SPRHS has not publicly confirmed the incident, the June 17 date, the 1.4 TB quantity, or the detailed contents of the stolen material.
Undisclosed Connecticut Medicaid provider
June 18, 2026
•[ leak, financial, healthcare ]
An unauthorized third party first gained access on June 18, 2026 to an undisclosed Connecticut Medicaid providers reimbursement account on the Gainwell Technologies-operated HUSKY provider portal and obtained claims and payment information for approximately 41,000 HUSKY Health members. Gainwell detected the unauthorized access on June 25. Connecticut DSS and Gainwell determined that the activity appeared financially motivated rather than directed specifically at patient data. Electronic health records, Social Security numbers, and financial account information were not compromised, and no evidence of misuse had been identified when notifications began. This incident is separate from the March 2026 compromise of Hartford HealthCare payment accounts on the same portal.
Partnered Health Pty Ltd
June 23, 2026
•[ ransomware, healthcare, leak ]
On June 23, 2026, Partnered Health became aware that a malicious actor had accessed data in parts of its clinic network. The company currently lists 17 clinics where healthcare-record information was affected and five additional clinics where the extent of impact remains under investigation. Partnered Health later confirmed that 11 files tied to the incident had been published online and that additional patients and some employees were affected. INC claimed responsibility and approximately 500 GB of theft, but Partnered Health has not verified that quantity and was still assessing the published material. No operational or clinical-service disruption was reported.
Quest Health Solutions, LLC
June 24, 2026
•[ leak, malware, healthcare ]
Anubis listed Quest Health Solutions on June 24, 2026 and claimed theft of employee data and internal files. DataBreach.com's verified searchable dataset confirms a data compromise. Although Anubis malware can encrypt or wipe data, incident-specific reporting does not establish that either capability was deployed against Quest, and no public victim statement, regulator notice, or report confirming an outage or service interruption was located as of August 12, 2026.
Cardiology Associates of Port Huron, P.C.
June 25, 2026
•[ ransomware, leak, healthcare ]
Orova stated that it compromised Cardiology Associates of Port Huron on June 25, 2026, stole approximately 144 GB of data comprising 244,215 files, and encrypted some servers. The practice did not publicly confirm the attack. Orova subsequently published stolen data, and later independent review of the released material identified more than 150,000 patient records containing personally identifiable and protected health information, corroborating the data-theft component of the group's claim.
Washington State Department of Social and Health Services
June 29, 2026
•[ insider, healthcare, government ]
In March 2026, the Washington State Department of Social and Health Services discovered that an employee had accessed client accounts in an internal database for reasons unrelated to authorized job duties. DSHS terminated the individual's system access, reviewed the employee's complete access history, and found that the affected records contained identity and program-enrollment information but no evidence of access to diagnoses, test results, treatments, claims, or clinical notes.
PAI Pharma
June 30, 2026
•[ ransomware, healthcare, manufacturing ]
PAI Pharma, a Greenville, South Carolina maker of generic liquid and unit-dose drugs, was listed on Brain Cipher's leak site on June 30, 2026; the group claimed theft of about 1.4 TB and threatened to publish it. PAI Pharma had issued no public notice as of September 2026.
Amgen Inc.
July 1, 2026
•[ hack, healthcare, technology ]
In July 2026, Amgen identified unauthorized activity involving data stored in cloud environments hosted by third-party service providers. The company confirmed that proprietary data, patient protected health information, and other information were exfiltrated. Amgen implemented containment measures and engaged independent forensic experts. It reported no impact on its products, manufacturing operations, financial reporting systems, or ability to meet patient needs, and the investigation remained ongoing.
Bethany Lutheran Homes, Inc. d/b/a Eagle Crest Communities
July 1, 2026
•[ ransomware, leak, healthcare ]
SafePay claimed responsibility for compromising Bethany Lutheran Homes, Inc., which operates as Eagle Crest Communities, on 1 July and threatened to publish the full leak unless the organization contacted the group. A verified searchable dataset containing 16,556 name-and-telephone rows confirms that Eagle Crest data was compromised. The access method, encryption, and operational impact were not disclosed, and no service interruption was identified. Anubis separately claimed an Eagle Crest patient-and-employee data breach later in July, but available evidence does not establish whether that represented the same compromise or a separate event.
