Ulaval
November 4, 2026
•[ ransomware, healthcare, education ]
Ulaval was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Education. Country: Canada. The company is engaged in radiology and medical services, as confirmed by its name and mentions of a radiologists' association in the archive documents.
University of Health Sciences and Pharmacy in St. Louis
April 1, 2023
•[ ransomware, education, healthcare ]
The university's CIO/CISO dates LockBit's entry to April 1, 2023, using compromised employee credentials. About 13 days later, attackers encrypted servers and destroyed an onsite backup. They demanded US$1.25 million; the university did not pay. Stolen files were published around June 12. Cached server credentials were compromised. April 1 dates initial access, not encryption or confirmed extraction; the August 2026 interview describes a 2023 incident.
Premier Health Partners
June 7, 2023
•[ leak, healthcare ]
Unauthorized access between June 7 July 12 2023 led to acquisition of sensitive personal and health information of 10,833 individuals. No service disruption; services remained operational. No perpetrator identified. Incident discovered July 12 2023; disclosure publicized via Yahoo on August 30 2025.
Undisclosed North American medical research university
September 1, 2023
•[ espionage, malware, healthcare ]
In September 2023, UNC6508 compromised a REDCap server belonging to an undisclosed North American medical research university. Three months later, the actor deployed the INFINITERED backdoor, harvested credentials, persisted through REDCap upgrades, obtained domain-administrator access, and created a Google Workspace content-compliance rule that silently forwarded selected emails to an actor-controlled account. Activity continued through November 2025. Google also identified additional organizations in the United States and Canada compromised with INFINITERED, but this row represents the detailed September 2023 university victim.
Presbyterian Healthcare Services
May 29, 2024
•[ leak, healthcare ]
The information of over 300,000 Presbyterian Healthcare Services patients is compromised as a result of a data breach at law firm Thompson Coburn.
Undisclosed ransomware-as-a-service group
January 1, 2025
•[ ransomware, healthcare, transportation ]
CSE identified an undisclosed ransomware-as-a-service group responsible for more than 25 incidents affecting Canadian transportation, healthcare, pharmaceutical, and business organizations. Working with Five Eyes partners and law enforcement, CSE rendered the group's infrastructure inoperable and deleted a large amount of stolen data advertised for sale. CSE separately reported disruptions against parts of the infrastructure of 10 ransomware groups but did not state whether this group was included among them.
Excelsior Orthopaedics
January 7, 2025
•[ ransomware, healthcare, financial ]
Excelsior Orthopaedics suffered a ransomware attack attributed to the Monti threat group, which disrupted operations across all seven of its facilities in Western New York. The attackers exfiltrated approximately 300GB of sensitive data, including medical and financial records, and rendered core systems nonfunctional for several weeks, forcing staff to rely on manual processes during recocery
Terry J. Dubrow, MD, A Medical Corporation
January 16, 2025
•[ leak, healthcare ]
An unauthorized actor accessed a portion of the practice's network beginning January 16, 2025 and acquired patient records. The practice confirmed the affected information on July 27, 2026 and later notified patients.
New York Blood Center (NYBC)
January 26, 2025
•[ hack, healthcare ]
New York Blood Center said it does not have a "specific timetable for system restoration" following the attack, which has led to canceled appointments and delays
NorthBay Healthcare Corporation
January 29, 2025
•[ leak, healthcare ]
NorthBay Healthcare Corporation in California notifies 569,012 people of a breach that occurred between January 11 to April 1, 2024.
Autism Services of Saskatoon Inc.
March 20, 2025
•[ ransomware, healthcare, misconfiguration ]
Autism Services of Saskatoon discovered a ransomware attack on March 20, 2025 after certain systems became inaccessible. A forensic investigation determined that the threat actor likely accessed and exfiltrated information collected from clients and former employees, and a ransom demand was found on a desktop computer. Autism Services isolated affected systems, terminated network access, and began restoring servers the following day. The last observed unauthorized activity occurred March 20. The organization notified 2,168 affected individuals, and subsequent monitoring found no evidence that the copied information was published or used for fraud. Investigators could not conclusively identify the entry point or responsible actor, although a firewall vulnerability was considered the likely access path.
Academic Urology & Urogynecology of Arizona
May 18, 2025
•[ ransomware, healthcare, leak ]
Academic Urology detected unauthorized network access on May 22, 2025 and later determined that files may have been accessed or acquired between May 18 and May 22. INC claimed the incident on June 17, 2025, but the practice did not confirm that attribution. The practice notified 73,281 people after completing its review on January 30, 2026; no operational disruption was reported.
Madera Community Hospital
May 28, 2025
•[ ransomware, healthcare ]
An unauthorized third party accessed Madera Community Hospital's network on May 28 and May 29, 2025. The hospital later determined that files from part of its network were likely acquired, ultimately identifying 150,810 affected individuals. An unidentified extortion group claimed responsibility and demanded payment but later withdrew its demand after learning the victim was a hospital, stating that it did not want to harm patients. No known group has publicly identified itself as the perpetrator, and the hospital found no evidence that the compromised information was publicly released.
Hôpital Privé de la Loire
June 26, 2025
•[ hack, leak, healthcare ]
Hpital priv de la Loire in Saint-tienne, France (Ramsay Sant) had its electronic patient record accessed June 26-July 1, 2025 via a doctor's account. Hacker "Marak" claimed the theft and tried to sell the data. CNIL fined the hospital 500,000 on Sept. 3, 2026.
Blue Fish Pediatrics, L.L.P.
July 11, 2025
•[ leak, healthcare ]
Blue Fish Pediatrics determined that an unauthorized party had access to a limited number of files in its computer systems between 2025-07-11 and 2025-07-17. The practice completed its file review on 2026-05-04 and notified affected individuals in June 2026. The incident affected 62,150 individuals in total, including 41,485 Texas residents. Blue Fish Pediatrics did not publicly identify the actor, motive, or initial access method.
Colorado Health Network Inc.
July 29, 2025
•[ hack, leak, healthcare ]
Colorado Health Network determined that an unauthorized individual viewed and obtained files from its network in an incident dated 2025-07-29. The organization began notifying affected individuals on 2026-06-18 and reported 68,212 affected people. Cephalus claimed responsibility and alleged that it stole more than 900 GB of data, but Colorado Health Network did not publicly confirm the actor or the claimed volume. The initial access method and any operational disruption were not disclosed.
MCBS, LLC
September 22, 2025
•[ leak, healthcare, technology ]
MCBS experienced unauthorized access to its network from September 22 through September 26, 2025, detecting the activity on September 25. Its investigation determined that an unauthorized user may have accessed or removed files containing personal and medical information belonging to patients of seven healthcare clients. HHS lists 1,261,464 affected individuals. PEAR claimed responsibility, alleged theft of more than 3 TB of company, client, employee, partner, vendor, financial, and patient data, and subsequently published the allegedly stolen information for download. No encryption or operational disruption was reported.
Unlimited Technology Systems, LLC
October 5, 2025
•[ ransomware, healthcare, technology ]
An unauthorized actor accessed Unlimited Technology Systems' commercial data center from October 5 through October 10, 2025 and obtained copies of files containing personal and protected health information. Unlimited later confirmed the incident was ransomware and that several systems hosting its g4-Centricity for Vector platform were encrypted, prompting suspension of access to hosted systems. The incident ultimately affected 3,803,750 individuals. No ransomware group has publicly claimed responsibility.
The Connecticut Institute for the Blind, Inc. d/b/a Oak Hill
October 6, 2025
•[ leak, healthcare ]
The Connecticut Institute for the Blind, Inc., doing business as Oak Hill, experienced a security incident on or about October 6, 2025. Its investigation found that files in certain affected accounts were accessed or acquired without authorization. Oak Hill determined on May 13, 2026, that the files contained personal information, mailed notices on June 30, and reported 1,556 affected individuals to HHS. No operational disruption was reported, and Oak Hill reported no known identity or financial fraud resulting from the incident.
Greenbaum, Rowe, Smith & Davis LLP
November 25, 2025
•[ hack, brute-force, healthcare ]
An unauthorized party used compromised login credentials to access Greenbaum, Rowe, Smith & Davis LLP's network server between November 25 and November 27, 2025. The firm discovered the intrusion on November 27 and determined on April 15, 2026 that files containing patient information from healthcare clients had been acquired. Greenbaum reset passwords, replaced compromised equipment, notified law enforcement, and offered identity-monitoring services. No operational disruption was reported, no group claimed the attack, and no stolen data was found published or misused. Criminal and Financial are bounded inferences from credential-based theft of identity and health data; the actor and country remain undetermined.
