Data breaches have recently been announced by Terry J. Dubrow, MD, SunCloud Health, Integer Precision Technologies, Minnesota ENT, and Nipro Medical Corp.

Terry J. Dubrow, MD, California

Terry J. Dubrow, MD, a Beverly Hills, CA-based plastic surgeon, has notified the California Attorney General about a recent security incident involving patient information. The practice was contacted by an individual who claimed to have breached its computer systems and copied sensitive patient information. An investigation was launched to establish whether the claim was legitimate, and it was confirmed that there had been unauthorized access to parts of its network starting on January 16, 2026, and that files had been copied.

The affected data was reviewed, and on July 27, 2026, the practice confirmed that patients’ personal information had been obtained, including names, information collected on patient charts, and referring physician information. That information may have included contact information, Social Security numbers, driver’s license numbers or state ID numbers, birth dates, prescription information, treatment information, procedure images, and X-rays. The practice has implemented additional security measures to reduce the risk of similar incidents in the future, and the affected individuals have been offered complimentary identity theft protection services. The number of affected individuals has yet to be publicly disclosed.

SunCloud Health, Illinois

SunCloud Health, a Northbrook, Illinois-based behavioral health treatment network, has recently disclosed a data security incident involving the protected health information of 2,594 individuals. Unusual activity was identified in certain employee email accounts. Steps were taken to secure its email system, and an investigation was initiated to determine the cause of the activity. The investigation confirmed unauthorized access to certain employee email accounts between April 22, 2026, and May 4, 2026.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The affected accounts were reviewed, and on June 16, 2026, SunCloud Health determined that the accounts contained patient names and medical information related to the services provided, including diagnoses, medications, and treatment information. The affected individuals were notified by mail on July 23, 2026; existing security protocols have been enhanced, and IT systems are being monitored, with additional safeguards being evaluated.

Integer Precision Technologies, Massachusetts

Integer Precision Technologies, a Hudson, Massachusetts-based company that makes coatings for medical devices, has recently disclosed a data security incident involving a cloud-based SaaS file sharing application. While it is unclear exactly when the incident was detected or for how long access was possible, the investigation determined that an unauthorized third party accessed the application and copied files.

Assisted by a third-party data review firm, the company determined that the files contained personal information including names, addresses, email addresses, phone numbers, dates of birth, Social Security numbers, driver’s license numbers, passport numbers, financial account numbers, and some health-related information. The affected individuals have been offered 24 months of complimentary credit monitoring and identity theft protection services, and steps have been taken to enhance security. The number of affected individuals has yet to be publicly disclosed.

Minnesota ENT

Oakdale Ear, Nose, & Throat PA, doing business as Minnesota ENT, has started notifying individuals affected by a recent email security incident. It is unclear from the substitute breach notice when the security incident was detected, or for how long it lasted. The notice states that six employee email accounts were accessed by an unauthorized third party and, assisted by third-party cybersecurity experts, Minnesota ENT determined on July 15, 2026, that the accounts contained HIPAA-protected data.

Data compromised in the incident included first and last names, birth dates, Social Security numbers, driver’s license numbers, financial account information, medical information, and health insurance information.  Notification letters started to be mailed to the affected individuals on August 12, 2026. The letters include information on the steps that can be taken to protect against data misuse. The number of affected individuals has yet to be publicly disclosed.

Nipro Medical Corp., New Jersey

Nipro Medical Corp., the U.S. subsidiary of the Japanese company Nipro Corp, has identified a security incident that exposed sensitive information. The New Jersey-based company provides medical supplies to hospitals, including renal care products, vascular and interventional devices, and disposable hospital supplies. Nipro said it identified suspicious activity within its IT systems and determined that an unauthorized third party may have viewed or acquired sensitive information such as credit and debit card information, Social Security numbers, and other government identifiers.  The affected individuals have been offered 24 months of complimentary credit monitoring services. The number of affected individuals has yet to be publicly disclosed.

The post Data Theft/Extortion Incident Confirmed by Beverly Hills Plastic Surgeon appeared first on The HIPAA Journal.

Data breaches have recently been announced by the healthcare navigation and care coordination company Quantum Health, Heart of America Medical Center, and Precision Imaging Centers.

Quantum Health

Quantum Health, a Dublin, Ohio-based healthcare navigation and care coordination company that helps self-insured employers manage employee benefits and lower healthcare costs, has disclosed a cybersecurity incident that it identified in May 2026.

The incident started with a vishing attempt. The attacker called a Quantum Health user on May 29, 2026, and tricked them into providing access to the Quantum Health network. Between May 29, 2026, and June 1, 2026, the unauthorized third party had access to its network and acquired files. On June 1, 2026, Quantumn Health experienced a network disruption affecting both internal and external systems. An investigation was launched, which traced the incident back to the vishing call. The threat group behind the incident was not named, and no ransomware group appears to have claimed responsibility for the attack. These tactics are commonly used by the ShinyHunters threat group, which was the subject of a recent Health-ISAC cybersecurity alert.

On June 8, 2026, Quantum Health confirmed that the exfiltrated data included personal and protected health information, including names, addresses, email addresses, phone numbers, dates of birth, demographic information, Social Security numbers, diagnosis and treatment information, prescriptions, provider names, dates of service, insurance information, and claims or benefits information. The affected individuals are being offered complimentary credit monitoring and identity theft protection services. It is unclear how any companies have been affected by the incident, and the number of affected individuals has yet to be publicly disclosed.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Heart of America Medical Center

Heart of America Medical Center, a faith-based nonprofit hospital and medical facility in Rugby, North Dakota, has experienced a cybersecurity incident that exposed patient data. Suspicious network activity was identified on or around June 12, 2025, and the investigation determined on September 15, 2025, that an unauthorized third party accessed its network and exfiltrated files, some of which contained patient information, including names, Social Security numbers, medical records, and other medical information.

A third-party vendor was engaged to review the affected data, and that process concluded on May 12, 2026. The findings were reviewed, and that process was completed on June 9, 2026. Contact information was verified, and on July 9, 2026, Heart of America Medical Center obtained a final list of individuals to notify. Notification letters have now been sent to the affected individuals, who have been offered complimentary single-bureau credit score, credit report, and credit monitoring services. Heart of America Medical Center has implemented additional technical and administrative safeguards to enhance data privacy and security.

The Embargo ransomware group claimed responsibility for the incident and claimed to have exfiltrated around 800 GB of data in the attack. The incident is not yet shown on the HHS’ Office for Civil Rights website, so it is unclear how many individuals have been affected.

Precision Imaging Centers

The Medical Imaging Partnership, doing business as Precision Imaging Centers in Florida, has announced a hacking incident that exposed patient information. Suspicious activity was identified within its computer network on May 7, 2026. The investigation determined that its network was accessed by an unauthorized third party, who copied files from its systems. The investigation and data review are ongoing, so the exact data types involved and the names of the affected individuals have yet to be determined. As such, the incident has been reported to the HHS’ Office for Civil Rights using a placeholder estimate of 501 individuals. The total will be updated when the file review is concluded.

Precision Imaging Centers has advised current and former patients to remain vigilant against identity theft and fraud by monitoring their free credit reports, accounts, and explanation of benefits statements for signs of data misuse. Notification letters will be mailed to the affected individuals as soon as possible after the data review is concluded.

The post Vishing Attack Provides Threat Act with Access to Quantum Health Network appeared first on The HIPAA Journal.