Undisclosed trusted vendor serving Ascent Healthcare Management facilities
November 25, 2025
•[ leak, healthcare ]
An unauthorized actor used credentials stolen from one trusted vendor to access systems maintained by a second unnamed trusted vendor between November 25 and November 28, 2025 and copied files containing resident information for three Ascent Healthcare Management-affiliated skilled nursing facilities. The incident was discovered on June 1, 2026. Separate HHS filings reported 1,397 affected individuals at Bear Mountain Health and Rehabilitation, 1,551 at Elevate Health & Rehabilitation, and 1,045 at Swannanoa Valley Health and Rehabilitation. Because the primary compromise occurred in the shared vendor environment, this is coded as one vendor event rather than three separate facility intrusions. The facilities said they had credible evidence that the copied files were permanently deleted and not published; the vendor, actor, motive, and technical acquisition point remain undisclosed.
National Association on Drug Abuse Problems (NADAP)
November 26, 2025
•[ ransomware, healthcare ]
Unauthorized access to NADAP's network occurred on or around November 26, 2025 and was discovered on January 10, 2026. NADAP isolated and took impacted systems offline as a containment measure. Genesis claimed responsibility on March 6, 2026 and said it stole approximately 2 TB of medical and HR data. NYC Health + Hospitals confirmed that 5,086 of its patients were among those whose protected health information was accessed.
Anatomic and Clinical Laboratory Associates, P.C.
December 1, 2025
•[ ransomware, healthcare, leak ]
Anatomic and Clinical Laboratory Associates detected potential unauthorized activity on December 1, 2025. Its investigation found that an unauthorized actor may have accessed its network and downloaded files. Insomnia later claimed responsibility, but the laboratory did not publicly attribute the incident to the group. No encryption or operational disruption was reported.
IMA Diligence Services, LLC
December 8, 2025
•[ hack, leak, healthcare ]
An unauthorized actor accessed a legacy file server managed by a third party between December 8 and December 16, 2025 and exfiltrated files containing personal, financial, and medical information. IMA Diligence Services reported 525,306 affected individuals. Genesis later claimed responsibility and alleged theft of approximately 700 GB, but the company did not publicly confirm the actor's attribution or claimed volume.
Buena Vista Management Services, LLC dba Windward Life Care
December 8, 2025
•[ leak, healthcare ]
Windward Life Care detected unusual network activity on December 8, 2025 and determined that an unauthorized party may have viewed or copied files containing personal and protected health information. Sinobi claimed on January 5, 2026 that it stole approximately 25 gigabytes and later published the material. Windward completed its data review on April 6, notified 12,913 affected individuals beginning April 10, and offered identity-protection services. No victim-specific evidence established encryption or operational disruption.
United Medical Doctors
December 12, 2025
•[ ransomware, healthcare, leak ]
United Medical Doctors confirmed unauthorized access to its systems at varying times between December 12, 2025 and March 31, 2026, during which an unauthorized user accessed and/or acquired files. UMD detected suspicious activity on March 31. Insomnia publicly claimed the organization on April 9 and threatened disclosure of stolen information. DataBreach.com subsequently indexed 638,670 rows associated with the incident. No independently verified operational disruption has been established.
Lifespan Physician Group of Massachusetts, Inc. d/b/a Brown Health Medical Group-MA
December 15, 2025
•[ leak, healthcare, financial ]
An unauthorized actor accessed a historic file server at Brown Health Medical Group-MA's Hawthorn location between December 15 and December 16, 2025. The organization isolated the affected server and later determined that files containing personal, medical, financial and personnel information had been accessed. The electronic health record system was not affected. HHS reports 311,760 affected individuals, including 290,357 Massachusetts residents. No known ransomware or extortion group has claimed responsibility.
Nephrology Associates, M.D., P.A.
January 17, 2026
•[ leak, healthcare ]
Kansas kidney-care practice Nephrology Associates, M.D., P.A. had its network accessed Jan 17-Apr 9, 2026, and patient data removed. The Gentlemen listed it on its leak site Mar 7 and offered the data for sale. The practice reported 24,088 patients affected to HHS on July 29.
Xsolis, Inc.
January 20, 2026
•[ phishing, healthcare, technology ]
A targeted phishing attack on January 20, 2026 resulted in unauthorized access to a limited portion of Xsolis's environment through January 22. The unauthorized actor acquired files containing personal and protected health information supplied by Xsolis's healthcare clients. Xsolis reported no known actual or attempted misuse of the information.
Rocky Mountain Associated Physicians, P.C.
January 26, 2026
•[ leak, healthcare ]
Rocky Mountain Associated Physicians stated that an unauthorized actor accessed systems including its patient database and other data files at an unknown date no earlier than October 30, 2025, and that it confirmed compromised patient information on February 2, 2026. PEAR listed the practice on its leak site on January 30, 2026 and later released data. The source's January 26, 2026 breach date is used as the event date. No encryption or operational disruption was reported.
Penobscot Valley Hospital
January 28, 2026
•[ hack, healthcare ]
Penobscot Valley Hospital detected suspicious network activity on January 28, 2026, secured its systems, engaged forensic specialists, and notified law enforcement. The investigation determined on February 12 that an unauthorized individual may have accessed files and folders on the hospital network and concluded on June 4 that affected files contained personal and protected health information belonging to patients and employees. A federal healthcare-breach record reports 33,107 affected individuals, but the patient-employee split was not disclosed. Notifications began in July. No operational disruption or responsible group was reported.
Professional Compounding Centers of America, Inc.
February 10, 2026
•[ ransomware, healthcare, technology ]
Nitrogen claimed on February 10, 2026 that it had compromised Professional Compounding Centers of America's network, exfiltrated a significant amount of data, and would publish it unless its demands were accepted. DataBreach.com subsequently indexed 1,500,874 rows and dated the published dataset to May 12. PCCA did not publicly confirm the actor's claim, and no operational disruption was documented.
Rockwood Retirement Communities
February 26, 2026
•[ leak, healthcare, technology ]
KAIROS listed Rockwood Retirement Communities on its leak site on February 27, 2026. DataBreach.com subsequently indexed 132,606 structured records associated with the breach and dated the underlying event February 26. The records support classification of the affected asset as a database-backed application server, although the initial access vector was not disclosed. Rockwood operates nonprofit senior-living communities in Spokane. No victim notice or independent report confirmed encryption or operational disruption.
Physicians' Clinic of Iowa
February 26, 2026
•[ leak, healthcare ]
Anubis claimed a data breach at Physicians' Clinic of Iowa on February 26, 2026 and published images reportedly showing personal identifiers and protected health information. DataBreach.com later indexed 158,631 structured records. The database-like patient records support classification of the affected asset as an application server, although the initial access vector was not disclosed. The clinic has not publicly confirmed the attribution or disclosed the precise number of affected patients, encryption, or operational disruption.
Novo Nordisk A/S
March 1, 2026
•[ ransomware, leak, healthcare ]
FulcrumSec claimed that it obtained access in March 2026 through a GitHub access token, cloned Novo Nordisk repositories, obtained additional credentials, remained in the environment for more than two months, and stole more than 700,000 files totaling approximately 1.3 TB before demanding $25 million. Novo Nordisk confirmed unauthorized access to a limited number of internal IT systems and the external copying of non-public and personal data, but it did not publicly attribute the incident to FulcrumSec or confirm the actor's claimed volume and contents. Reuters could not independently verify the authenticity of the published data. Novo Nordisk temporarily took certain internal systems offline for containment, while stating that its core business operations remained operational. Because only March 2026 was reported for initial access, 2026-03-01 is used as the normalized event date.
Lewis Drug
March 3, 2026
•[ ransomware, leak, healthcare ]
AiLock claimed responsibility for an intrusion involving Lewis Drug in early March 2026 and alleged theft of approximately 110 GB. DataBreach.com dated the associated dataset to March 4 and indexed 22,549 rows. Public evidence supports a March 2026 event rather than the previously coded July 2025 date. No encryption or operational disruption was publicly documented.
Valley Family Health Care
March 7, 2026
•[ ransomware, healthcare, leak ]
DataBreach.com indexed 1,891,536 rows associated with Valley Family Health Care and dated the breach to March 7, 2026. Insomnia listed the organization on its data-leak site on March 18, 2026. Public reporting did not identify the access vector or document encryption or operational disruption.
Evaluate Ltd.
March 15, 2026
•[ ransomware, technology, healthcare ]
Everest publicly claimed Evaluate, a Norstella company, on March 15, 2026 and threatened publication of stolen data unless the company entered negotiations. Independent breach monitoring recorded approximately 1.33 TB associated with the claim, and DataBreach.com subsequently indexed 248,458 rows. Evaluate Ltd. is registered in England and Wales and headquartered in London, where it provides pharmaceutical and biotechnology market intelligence and analytics. No operational disruption has been independently established.
Ultrahuman
March 27, 2026
•[ leak, malware, healthcare ]
On March 27, 2026, attackers used credentials stolen from a malware-infected employee laptop to obtain read-only access to Ultrahuman's internal analytics system. Ultrahuman said wellness data belonging to approximately 0.1% of users was accessed, took the affected system offline, and revoked access. The company reported that passwords, payment information, production systems, and Ultrahuman Ring devices were not compromised and did not confirm whether data was exfiltrated.
Undisclosed non-clinical operational-support vendor used by Lumexa Imaging
March 31, 2026
•[ hack, healthcare ]
An unauthorized actor accessed a network-server environment operated by Lumexa Imaging's unnamed non-clinical support vendor between March 31 and April 9, 2026 and took patient documents from a network segment dedicated to Lumexa-affiliated radiology practices. Lumexa disconnected its systems from the vendor on April 9. Before reconnection, the vendor reset passwords, scrubbed and validated affected systems, and added monitoring. No service disruption, ransomware claim, named perpetrator, or misuse of the data was reported.
