Republic Health Insurance Fund of Serbia (RFZO)
April 1, 2026
•[ ransomware, healthcare, government ]
Serbian police arrested three INF Grupa members in Aug 2026; prosecutors allege suspect L.D. accessed the network of Serbia's Republic Health Insurance Fund (RFZO) between April and August 2026, took a large amount of data, demanded ransom and damaged data in a ransomware attack.
Arkansas Oral & Maxillofacial Surgeons
April 7, 2026
•[ ransomware, leak, healthcare ]
PEAR listed Arkansas Oral & Maxillofacial Surgeons in April 2026 and threatened to release allegedly stolen patient information. DataBreach.com later indexed 189,905 associated rows. The practice did not publicly confirm the actor's attribution or claimed scope, the access vector was not established, and no operational disruption was documented.
Aitkin County Health and Human Services
April 7, 2026
•[ phishing, healthcare, government ]
Cybercriminals used phishing messages to obtain access to three Aitkin County Health and Human Services email accounts between April 7 and April 8, 2026. The attackers downloaded the contents of one employee mailbox, including a Minnesota Department of Human Services MnCHOICES report containing information on 82,384 individuals. Aitkin County and Minnesota DHS reported 83,114 affected individuals in total. The actors and motive were not identified.
LHC Group
April 7, 2026
•[ social, phishing, healthcare ]
Louisiana home health provider LHC Group said a hacker used credentials stolen by phoning an employee to access patient files on a vendor platform from 7-15 Apr 2026. Notices went to 28,000+ people in Sep 2026; the FBI was contacted.
Ohio Living
April 16, 2026
•[ ransomware, healthcare, financial ]
Ohio Living detected suspicious network activity on April 17, 2026. Its investigation determined that an unauthorized actor accessed systems and copied files from its network between April 16 and April 17. Ohio Living secured the network and began reviewing the files; no operational disruption was reported, and the 500-person figure reported to HHS was preliminary. On August 5, the Dark Project ransomware group claimed responsibility for an April 2026 attack on Ohio Living and alleged that it stole at least 600 GB, including at least 5,000 files containing employee, patient, medical, insurance, Social Security, financial, and banking information. Ohio Living had not publicly confirmed the attribution or the claimed volume.
Family Medical Associates of Raleigh, P.A.
April 18, 2026
•[ leak, healthcare ]
Family Medical Associates of Raleigh identified suspicious activity on 7 May. Its investigation found that an unauthorized third party intermittently accessed certain systems between 18 and 20 April and downloaded internal data containing protected health information. Genesis claimed responsibility on 3 June and threatened disclosure. A verified searchable dataset containing 126,856 rows confirms the data compromise. The practice did not report encryption, system downtime, or interruption of patient services, and the initial access method remains undisclosed.
Cherry Health (Cherry Street Services, Inc.)
April 19, 2026
•[ leak, healthcare ]
On or about 2026-04-19, Cherry Health detected suspicious activity involving its network. An investigation determined that an unauthorized individual accessed and copied certain information. Cherry Health's preliminary notice stated that the data could relate to current or former patients and current or former staff members and that its review of the affected files was continuing. The organization had not identified the actor, access method, total number of affected individuals, or evidence that the information had been used for identity theft or fraud.
ViaQuest, Inc.
April 21, 2026
•[ hack, healthcare ]
Anubis listed ViaQuest on April 21, 2026 and claimed theft of approximately 4.1 TB containing patient, employee, medical, and administrative information. DataBreach.com later indexed 224,544 rows associated with ViaQuest. A ViaQuest psychiatric and behavioral health entity separately reported a hacking/network-server incident affecting at least 6,420 people to HHS. No independently verified operational disruption has been established.
GO2 Health
April 24, 2026
•[ phishing, healthcare, leak ]
A phishing attack enabled unauthorized access to GO2 Health's main email mailbox on April 24, 2026. The clinic engaged specialists, contained the incident, reset credentials associated with delegated mailbox access, notified the Office of the Australian Information Commissioner on May 18, and began notifying affected patients on July 16. Automatic archiving limited exposed email to the preceding 12 months, and the primary patient-information system was not accessed.
GO2 Health
April 24, 2026
•[ phishing, healthcare ]
A phishing attack compromised GO2 Health's main email mailbox in April 2026. Investigation found that information contained in the mailbox may have been accessed, including some patients' Department of Veterans' Affairs identification numbers and other information patients had sent by email. The affected mailbox retained approximately 12 months of email. GO2 Health stated that its primary patient-record system was not accessed, notified the Australian privacy regulator on May 18, and notified affected patients in July.
The Walman Optical Company
April 27, 2026
•[ ransomware, manufacturing, healthcare ]
Medusa publicly claimed Walman Optical on April 27, 2026. DataBreach.com subsequently indexed 690,400 records containing personal and identity information associated with the company. Multiple federal data-security lawsuits were filed against Walman in May 2026 following the incident. Federal contracting and environmental records identify Walman's primary activity as ophthalmic goods manufacturing. No independently verified operational disruption has been established.
Champaign-Urbana Public Health District
May 6, 2026
•[ ransomware, healthcare, government ]
Champaign-Urbana Public Health District detected suspicious network activity on May 7, 2026. Its investigation determined that an unauthorized actor copied files from its computer network between May 6 and May 7. Reporting during the incident indicated that its primary website was disrupted and an alternate site was used. INC Ransom claimed responsibility and threatened to release data, but the district did not publicly confirm the attribution, encryption, or the number of affected individuals.
Monongalia County General Hospital Company
May 6, 2026
•[ phishing, healthcare ]
Monongalia County General Hospital Company discovered on May 6, 2026, that a small number of email users had been targeted in a successful phishing attack. A forensic investigation determined that an unauthorized party accessed certain Mon General email mailboxes on May 6 and that access was terminated the same day. No other hospital systems or data storage were affected. Mon General mailed notices to individuals whose patient information may have been contained in the mailboxes and offered two years of credit monitoring.
Lifelong Access
May 10, 2026
•[ ransomware, healthcare, leak ]
Lynx listed Lifelong Access on its extortion site on 10 May and threatened to publish stolen information unless the organization negotiated. A subsequently published searchable dataset contains 98,974 records with personal contact and birth-date information. Lifelong Access has not publicly confirmed the incident or disclosed the intrusion method, ransom demand, encryption, or operational impact. No service disruption was identified in public reporting.
Pratiksha Foundation Charitable Trust
May 12, 2026
•[ ransomware, healthcare, education ]
By 2026-05-12, FulcrumSec had contacted Pratiksha Foundation Charitable Trust after compromising educational databases and demanded $750,000 to prevent disclosure. The compromised information included children's medical and mental-health details, travel and location information, and parental income data. The Bombay High Court issued an ex parte interim order on 2026-06-12 restraining FulcrumSec from publishing or disseminating the stolen information and directing service providers to block identifiers used by the group.
Mid-Cumberland Human Resource Agency
May 18, 2026
•[ ransomware, healthcare, government ]
Insomnia claimed Mid-Cumberland Human Resource Agency as a victim in June 2026 and threatened publication of stolen information. DataBreach.com indexes 196,568 records and dates the underlying breach to May 18, 2026. MCHRA is a Nashville-based nonprofit providing social, health-support, meals, transit, and related human services. No independently verified operational disruption has been established.
DentaQuest, LLC
May 23, 2026
•[ leak, ransomware, healthcare ]
DentaQuest confirmed unauthorized access to a limited portion of its network and said it acted to contain the incident. ShinyHunters claimed responsibility and published approximately 234 GB of allegedly stolen data after negotiations failed. Have I Been Pwned identified information associated with approximately 2.6 million accounts. DentaQuest said its systems remained fully operational with limited customer-service disruption but did not publicly confirm the actor's claimed volume or attribution.
North Dallas Shared Ministries (Now-Forward, Inc.)
May 25, 2026
•[ leak, healthcare, finance ]
cmdorganization listed North Dallas Shared Ministries on May 25, 2026 and threatened to publish the full leak unless contacted. DataBreach.com later indexed 188,961 structured records containing personal identifiers and contact information. The organization, now operating as Now-Forward, provides financial assistance, food, clothing, medical and dental care, and other services to low-income residents. Public court dockets show data-breach class-action petitions against the organization, but no victim or regulator notice publicly established the initial access vector, encryption, or operational disruption.
Undisclosed external card-printing services provider
May 26, 2026
•[ hack, healthcare, government ]
An undisclosed external card-printing services provider notified Irelands Health Service Executive on the evening of May 26, 2026, that its systems had been attacked and a small number of HSE records had been accessed. HSE systems were not compromised. As a containment measure, HSE paused production of plastic medical, European Health Insurance, GP visit, drugs payment scheme, and long-term illness cards on May 27; plastic-card production remained paused as of July 10. Applications, eligibility, and access to healthcare continued through letters, digital verification, and provisional certificates. The providers identity, registered country, access method, actor, motive, and affected data fields were not disclosed.
Providence Medical Group
May 28, 2026
•[ ransomware, healthcare ]
Providence Medical Group, a physician practice group in the Dayton, Ohio area, was claimed by the Qilin ransomware group on May 28, 2026; a 346,802-row dataset with SSNs and birth dates was later indexed. The group has not publicly confirmed the incident.
