Hospital Español Auxilio Mutuo de Puerto Rico Settles Data Breach Lawsuit
A settlement has been agreed to resolve class action litigation against Hospital Español Auxilio Mutuo de Puerto Rico to resolve claims related to a 2023 cybersecurity incident and data breach. The incident that sparked the lawsuit was identified by the U.S. Department of Homeland Security (DHS). DHS notified Hospital Español on September 23, 2023, that a cybercriminal actor had likely breached its network. The investigation confirmed that its network had likely been compromised, although it was not initially clear whether patient data was involved.
A year later, on September 24, 2024, internal and external cybersecurity experts concluded that its network was compromised between August 2022 and September 2023 and that patient data was likely exfiltrated. Data compromised in the incident included names, contact information, health information, health insurance information, billing and claims information, Social Security numbers, and other government-issued ID numbers. Notification letters were mailed to the affected individuals on April 21, 2025, 575 days after the hospital learned from DHS that its network had likely been compromised.
The first class action lawsuit was filed on May 1, 2025. Additional plaintiffs were added to the lawsuit, and an amended complaint was filed – Jose A. Morales Rosario, et al. v. Hospital Español Auxilio Muto De Puerto Rico, Inc. – in the United States District Court for the District of Puerto Rico. The lawsuit alleged that Hospital Español failed to implement appropriate cybersecurity measures, was not effectively monitoring its network for intrusions, failed to adequately train its employees on cybersecurity, and did not issue timely notifications. When the notification letters were issued, the plaintiffs allege that Hospital Español obfuscated the nature of the data breach and the threat it posed.
The lawsuit asserted claims for negligence, negligence per se, breach of implied contract, unjust enrichment, invasion of privacy, breach of fiduciary duty, and declaratory judgment. Hospital Español sought to have the lawsuit dismissed as it maintains there was no wrongdoing and disagreed with the claims asserted in the lawsuit. All parties discussed the possibility of an early resolution to the litigation to avoid the costs and uncertainties of continued litigation. The terms of the settlement have now been agreed, and the settlement has received preliminary approval from the court. Under the terms of the negotiated settlement, Hospital Español agreed to pay attorneys’ fees and expenses, settlement administration and notice costs, and service awards for the class representatives.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
A $500,000 settlement fund will be established to provide monetary benefits to the class members. Those benefits are reimbursement of out-of-pocket expenses up to $2,500 per class member or an alternative cash payment, estimated to be $25 per class member. In addition to one of those two benefits, class members may also claim two years of credit and medical monitoring services. Hospital Español has also agreed to implement a range of data security measures to reduce the risk of similar incidents in the future. The deadline for opting out, objecting, and submitting a claim is December 21, 2026. The final fairness hearing has been scheduled for January 20, 2027.
The post Hospital Español Auxilio Mutuo de Puerto Rico Settles Data Breach Lawsuit appeared first on The HIPAA Journal.
Marathon Health Data Breach Reportedly Affects 5.7 Million Individuals – The HIPAA Journal
Marathon Health Data Breach Reportedly Affects 5.7 Million Individuals The HIPAA Journal
Marathon Health Data Breach Reportedly Affects 5.7 Million Individuals
State attorneys general have been informed about a substantial Marathon Health data breach that reportedly involved the personal and protected health information of almost 5.7 million individuals. Indianapolis, Indiana-based Marathon Health is an employer-sponsored healthcare provider. The company partners with employers, labor unions, and public sector organizations and provides advanced primary care through onsite and near-site health centers across the United States. According to its website, the company serves more than 600 self-funded employers, labor unions, and public sector organizations, operates more than 720 health centers in 41 U.S. states, has around 1,600 providers, and offers virtual care to individuals in all 50 states. Marathon Health has a patient base of around 3 million individuals.
Only a handful of state attorneys general publish information on the number of state residents affected by data breaches. The Massachusetts Attorney General was informed that 29,075 state residents were affected, and the Vermont Attorney General was notified that 8,858 state residents were impacted. While the website of the Texas Attorney General states that 234,534 Texas residents were affected, law firm Emery Reddy reports that the Texas Attorney General was informed that 5,684,735 individuals are being notified. As a HIPAA-covered entity, the data breach must be reported to the HHS’ Office for Civil Rights (OCR); however, it is not currently listed on the OCR data breach portal. If that total is confirmed, the Marathon Health data breach will rank as the fourth-largest healthcare data breach to be reported by a HIPAA-regulated entity this year.
A copy of the data breach notification letter is available on the website of the California Attorney General. The notice states that on August 24, 2026, suspicious activity was identified related to one of its employee accounts. The affected account was immediately disabled, and an investigation was launched to determine the nature and scope of the activity. Marathon Health learned that an unauthorized individual posed as a Marathon IT worker and tricked the employee into disclosing their credentials. The credentials provided access to a cloud-hosted application, and the unauthorized individual exported information from that application in the space of a few hours on August 24, 2026.
The social engineering tactics – impersonating an IT worker to steal credentials – are used by initial access brokers and several different cybercriminal groups, including the ShinyHunters and Scattered Spider threat groups. Neither group appears to have claimed responsibility for the attack, nor has any ransomware group.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Marathon Health’s review of the impacted data was completed on September 9, 2026. According to the notification letters to California residents, the impacted data included names, contact information, dates of birth, and Social Security numbers. The websites of the Texas and Vermont Attorneys General also state that medical information and health insurance information were compromised. Marathon Health has taken steps to prevent similar incidents in the future and is offering the affected individuals 12 or 24 months of complimentary credit monitoring services. Notification letters started to be mailed to the affected individuals on October 20, 2026.
Due to how Marathon Health operates, some individuals are likely to receive notification letters informing them that some of their data was compromised, when they have not received any healthcare services from the company. They may not be aware of Marathon Health or why the company has their data. The reason is that Marathon Health is provided with information on all enrolled plan members to allow it to verify coverage, communicate benefits, bill insurance companies, and schedule appointments. One of the affected clients is Indiana University, which informed employees and family members enrolled in the Anthem PPO HDHP or Anthem PPO $500 Deductible Plan that they are eligible to use Marathon Health centers, and as such, Marathon Health was provided with some of their information.
The post Marathon Health Data Breach Reportedly Affects 5.7 Million Individuals appeared first on The HIPAA Journal.
Cognitive Health Technologies Data Breach Affects 49,500 Individuals – The HIPAA Journal
Cognitive Health Technologies Data Breach Affects 49,500 Individuals The HIPAA Journal
Cognitive Health Technologies Data Breach Affects 49,500 Individuals
Data breaches have been announced by Cognitive Health Technologies in New York, City Ambulance Service in Texas, Baraga County Memorial Hospital in Michigan, The Speech Clinic in Georgia, and Innovative Alternatives in Texas.
Cognitive Health Technologies, New York
Cognitive Health Technologies LLC, a New York-based healthcare technology and IT consulting company, has disclosed a data security incident involving the protected health information of 49,467 individuals. According to its substitute data breach notice, suspicious network activity was identified on April 27, 2026. A forensic investigation was initiated to determine the nature and scope of the activity, which confirmed that its network had been accessed by an unauthorized third party between February 5, 2026, and April 28, 2026. During that time, there was unauthorized access and acquisition of files and folders containing protected health information.
The data review confirmed that the information compromised in the incident included names, dates of birth, health insurance information, medical histories, and treatment information. While patient data was compromised in the incident, no misuse of that information has been identified. Cognitive Health Technologies said it has reviewed its security policies and has implemented additional measures to protect against similar incidents in the future.
Viking Enterprises (City Ambulance Service), Texas
Viking Enterprises, doing business as City Ambulance Service in Spring, Texas, has notified the HHS Office for Civil Rights about a hacking incident affecting 14,324 individuals. The breach was reported to OCR on August 31, 2026, as an email-related incident. Little information has been released about the incident, although based on the report submitted to the Texas Attorney General, the compromised data includes names, addresses, dates of birth, medical information, health insurance information, and Social Security numbers.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The Qilin ransomware and data theft/extortion group claimed responsibility for the attack and maintains that sensitive data was stolen. It is unclear if ransomware was used in the attack. The July 19, 2026, listing on its dark web data leak site states that 14 GB of data was exfiltrated, and the stolen data has been published. The HIPAA Journal has not downloaded any of the data, so it cannot verify the claim; however, the screenshots uploaded as proof of compromise include some patient data.
Baraga County Memorial Hospital, Michigan
Baraga County Memorial Hospital in L’Anse, Michigan, has reported a data breach to the HHS’ Office for Civil Rights that involved unauthorized access to systems containing the protected health information of patients. At the time of publication, the number of affected individuals has yet to be determined. The breach has been reported using a placeholder figure of at least 501 affected individuals.
The hospital has not yet disclosed details of the incident or the information involved, other than the report to OCR that states this was a hacking/IT incident. A cybercriminal group claimed responsibility for the incident on July 4, 2026. The Wallstreet ransomware group added Baraga County Memorial Hospital to its dark web data leak site and claims to have exfiltrated data in the attack. The group leaked the stolen data when the ransom was not paid.
Innovative Alternatives, Texas
Innovative Alternatives, Inc., a Houston, Texas-based nonprofit mental health and counselling service provider, has disclosed a data security incident involving the personal and protected health information of approximately 1,500 current and former clients, employees, and donors. On August 2, 2026, Innovative Alternatives learned that a criminal cyber actor had accessed its network and used ransomware to encrypt files. Third-party cybersecurity and digital forensics experts were engaged to investigate the incident, and it was confirmed that data was accessed and may have been acquired. The electronic medical record system was not involved.
The data review confirmed that the compromised information included names, contact information, clinical counselling notes, and, for employees, contact and employment information. Innovative Alternatives has changed all system and user passwords, conducted additional security scans, and worked with third-party cybersecurity experts to strengthen its security measures to reduce the risk of similar incidents in the future. Notification letters were mailed to the affected individuals on October 2, 2026.
The Speech Clinic, Georgia
The Speech Clinic, a Waycross, Georgia-based speech-language pathology, occupational therapy, and physical therapy service provider, has experienced a data security incident. On August 10, 2026, the practice began experiencing difficulties accessing a computer at its Waycross location. The forensic investigation confirmed on August 17, 2026, that the computer had been remotely accessed by an unauthorized third party, as well as an older server containing pre-2017 patient records of 2,168 patients.
The forensic investigation could not confirm whether patient data was accessed, but unauthorized access could not be ruled out. For some patients, only their name was exposed, while others had a combination of name, date of birth, Social Security number, diagnosis, and other medical information.
The post Cognitive Health Technologies Data Breach Affects 49,500 Individuals appeared first on The HIPAA Journal.
UNM cyberattack diverts ambulances, disrupts care and raises HIPAA concerns – Acronis
The Hidden HIPAA Risks of Using Personal Cell Phones for Patient Communication – Healthcare IT Today
The Hidden HIPAA Risks of Using Personal Cell Phones for Patient Communication Healthcare IT Today
41,000 Connecticut Medicaid Recipients Affected by DHS Data Incident – The HIPAA Journal
41,000 Connecticut Medicaid Recipients Affected by DHS Data Incident The HIPAA Journal