NorthShore Health Centers, a nonprofit healthcare provider serving patients in Porter, Lake, La Porte, and Jasper Counties in Northwest Indiana, has warned patients about a cybersecurity incident that exposed some of their personal and protected health information.

According to its October 14, 2026, website notice about the data privacy event, the incident was first detected on August 10, 2026. An investigation was launched into suspicious network activity, with assistance provided by third-party cybersecurity and digital forensics experts. The investigation determined that an (unnamed) unauthorized third party had access to parts of its IT environment between August 10, 2026, and August 11, 2026, and potentially viewed or obtained files containing patient information.

The investigation and data review are ongoing as of October 14, 2026, so the number of affected individuals has not yet been confirmed. The types of information involved are still being assessed; however, it is likely that names, Social Security numbers, information related to medical treatments and conditions, and health insurance information were involved.

NorthShore Health Centers said it will mail notification letters to the affected individuals when the data review is concluded. Current and former patients should be aware that a ransomware group called Insomnia has claimed responsibility for the incident. The group added NorthShore Health Centers to its dark web data leak site and threatened to publish the stolen data if a ransom was not paid; it then proceeded to leak the stolen data. The HIPAA Journal has not downloaded any of the leaked data; however, the file tree suggests that patient data is likely included in the leaked dataset.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

As such, patients should consider placing a fraud alert and credit freeze with one of the three major credit reporting agencies and should carefully monitor their accounts and explanation of benefits statements for signs of data misuse. If data misuse is suspected, it should be promptly reported to the relevant institution (bank, insurer, etc.).

The post Data Breach Announced by NorthShore Health Centers appeared first on The HIPAA Journal.

Denver Health Medical Plan has notified more than 238,000 individuals about a vendor-related data incident. Data breaches have also been announced by Johns Hopkins Bayview Medical Center and BASS Medical Group.

Denver Health Medical Plan

Denver Health Medical Plan, a Denver, Colorado-based non-profit health plan affiliated with the Denver Health and Hospital Authority, has recently disclosed a data breach involving the protected health information of 238,083 current and former plan members. The incident involved SquareML, the provider of an artificial intelligence and machine learning analytics platform. On August 14, 2026, Denver Health Medical Plan was notified that an access key used by the vendor was found on a public website. The access key could have been used to access a database maintained by its vendor that contained plan members’ information.

The key had inadvertently been added to a public website by the vendor on June 27, 2025, where it remained for more than a year. The access key was deactivated on August 18, 2026. Data exposed in the incident included full names, city/state/zip code, demographic information, dates of birth, health plan eligibility information, provider names, admission/discharge/transfer information, and health metrics such as BMI, HbA1c, and eGFR. Financial information and Social Security numbers were not exposed.

Denver Health Medical Plan said it has not identified any evidence that the key had been misused. If the access key was found and used, it would not have been possible to download, export, delete, or alter data, and the key only provided read-only access.  While the data breach involved SquareML, notification letters have been mailed to the affected individuals by Denver Health Medical Plan.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Johns Hopkins Bayview Medical Center

Johns Hopkins Bayview Medical Center in Baltimore, Maryland, has discovered that the protected health information of 3,182 patients may have been exposed in an AI-related incident. A member of staff uploaded a spreadsheet containing limited patient data to a public AI tool that had not been approved for use by staff members. The error was identified by the medical center on September 21, 2026. The spreadsheet contained information on patients who had been admitted and treated between May 2026 and September 2026, including names, admission/treatment dates, department information, account numbers, medical record numbers, medications, and treating provider names.

When the incident was detected, the employee deleted the AI prompt and thread and removed the spreadsheet from the tool’s history. The medical center also contacted the provider of the tool and requested the data be deleted from the system. As a precaution against any data misuse, the affected individuals have been offered complimentary credit monitoring services for 12 months, and steps have been taken to prevent similar incidents in the future, including providing additional training to staff members on the AI platforms permitted for staff use.

BASS Medical Group

BASS Medical Group, a physician-owned multi-specialty practice based in Walnut Creek, California, has notified the California Attorney General about a data security incident first identified on September 4, 2026. An investigation was launched to determine the cause of suspicious network activity, and on September 22, 2026, the investigation determined that there had been unauthorized access to its network and personal and/or protected health information had been exposed and may have been viewed or acquired by an unauthorized third party.

The information that may have been compromised was limited to medical treatment codes, billing information, and health insurance information. BASS Medical Group has implemented additional safeguards to prevent similar incidents in the future. Notification letters started to be mailed to the affected individuals on October 22, 2026. The number of affected individuals has not yet been publicly disclosed.

The post Denver Health Medical Plan Discloses Vendor Breach Affecting 238K Members appeared first on The HIPAA Journal.