Centerwell, a provider of senior healthcare services in 30 U.S. states, has experienced a cyberattack and data breach. Lakeside Pediatric & Adolescent Medicine has recently notified individuals affected by an October 2024 data breach.

Centerwell

Centerwell, a Louisville, Kentucky-based provider of healthcare services to seniors, has recently reported a data breach to the Texas Attorney General that involved unauthorized access to patient information.

The scale of the breach is currently unclear, other than the personal and protected health information of 4,618 Texas residents was compromised in the incident. The breach could be substantially larger, as Centerwell provides senior healthcare services in 30 U.S. states. The Texas Attorney General was informed on March 6, 2026, that data compromised in the incident includes names, addresses, dates of birth, and medical information. At the time of writing, the affected individuals have not been informed by mail, and no known threat group has publicly claimed responsibility for the incident.

This post will be updated when further information about the incident is released.

Lakeside Pediatric & Adolescent Medicine

Lakeside Pediatric & Adolescent Medicine (Lakeside), a Coeur d’Alene, Idaho-based healthcare provider, has started notifying patients about an October 2024 data security incident. Lakeside identified unauthorized access to its computer systems in late 2024. The forensic investigation confirmed that an unauthorized third party accessed its computer systems on November 1, 2024, and on December 15, 2024, Lakeside confirmed that there had been unauthorized access and potential acquisition of files containing patient information.

On January 1, 2025, Lakeside confirmed in a website breach notice that personal and protected health information had been compromised in the incident, although the data review was ongoing at that time. On or around December 26, 2025, Lakeside confirmed the data types involved, although the website notice has not been updated to state what those data types are.

In a breach notice submitted to the Washington Attorney General, Lakeside confirmed that single-bureau credit monitoring and identity theft protection services are being offered to the affected individuals, and that 1,314 Washington residents were affected. The incident has not yet been listed on the HHS’ Office for Civil Rights website, so it is unclear how many individuals in total have been affected.

The post Data Breaches Reported by Centerwell & Lakeside Pediatric & Adolescent Medicine appeared first on The HIPAA Journal.

Bell Ambulance has confirmed that the protected health information of more than 230,000 patients was compromised in a February 2025 cyberattack. Data breaches have also been reported by Northwest Medical Homes in Oregon, and the New York Plastic surgeon, Alexes Hazen, MD.

Bell Ambulance, Wisconsin

Bell Ambulance, a Milwaukee, Wisconsin-based ambulance service, has notified the Maine Attorney General that a hacking incident identified in February 2025 has affected 237,830 individuals. Bell Ambulance detected unauthorized activity within its network on February 13, 2025. Third party cybersecurity experts were engaged to investigate the data breach, and confirmed that the protected health information of 114,000 individuals had been compromised in the incident. Notification letters were sent to those individuals on April 18, 2025; however, the data review had not yet concluded.

It has taken a year to review all data potentially compromised in the incident. On January 15, 2026, additional individuals were notified that they had been affected, and the data review concluded on February 20, 2026. Additional notification letters were mailed on March 9, 2026. Data compromised in the incident included first and last names, birth dates, Social Security numbers, driver’s license numbers, financial account information, medical information, and health insurance information. Bell Ambulance has offered the affected individuals complimentary credit monitoring and identity theft protection services for 12 or 24 months as a precaution. Bell Ambulance said it is unaware of any misuse of the impacted data at the time of issuing notification letters.

Northwest Medical Homes, Oregon

Springfield, Oregon-based Northwest Medical Homes, LLC, has notified certain patients about a cybersecurity incident first identified on May 13, 2025. Third party cybersecurity experts were engaged to help secure its systems, investigate the incident, and harden and enhance system security. The investigation confirmed that patients’ protected health information may have been compromised in the incident.

The breach notice submitted to the California Attorney General does not state what types of data were compromised in the incident, other than names and addresses. The individual notification letters state the exact types of data compromised for each patient.

Law enforcement has been notified, and the affected individuals have been offered complimentary credit monitoring and identity theft protection services for 12 or 24 months as a precaution. Northwest Medical Homes said it was unaware of any data misuse at the time of issuing notifications. The incident is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

Alexes Hazen, MD, PLLC, New York

Alexes Hazen, MD, PLLC, a New York-based board-certified plastic surgeon, has recently announced a cybersecurity incident and data breach. The practice learned about the incident on or around January 20, 2026, and started working with law enforcement and third-party cybersecurity experts to determine the nature and scope of the incident.

The investigation confirmed that an unauthorized third party accessed certain computer systems between June 23, 2025, and July 15, 2025, and may have exfiltrated a limited amount of patient data. The review of the affected data is ongoing, but it has been confirmed that the types of information compromised in the incident include names, dates of birth, demographic information, Social Security numbers, government-issued ID numbers, medical histories, conditions, procedure/diagnosis information, medical information, insurance information, payment information, and photographs.

Notification letters are being mailed to the affected individuals, and steps have been taken to harden security to prevent similar incidents in the future. The breach has been reported to the HHS’ Office for Civil Rights using a placeholder figure of 500 affected individuals. The total will be updated when the file review is concluded.

The post February 2025 Cyberattack Affected More Than 230K Bell Ambulance Patients appeared first on The HIPAA Journal.

PIH Health, a healthcare provider serving patients in Orange County and the San Gabriel Valley in California, has started notifying patients affected by a December 2024 ransomware attack. The attack disrupted systems used by Downey Hospital, Good Samaritan Hospital, Whittier Hospital, as well as urgent care clinics, home health, hospice services, and physicians’ offices.

The ransomware attack was detected on December 1, 2024, and the forensic investigation confirmed that the threat actor had access to its network between November 14, 2024, and December 23, 2024. As detailed in our December 16, 2024, coverage below, the threat actor claimed to have exfiltrated around 2 terabytes of data in the attack, and claimed the data included around 17 million patient records. A ransom demand was issued, and some of the stolen data was leaked online. PIH Health learned of the hacker’s claims but said at the time that it was unable to verify the authenticity of the ransom note or the data theft claims.

PIH Health has been reviewing the exposed data with the help of third-party specialists, and on or around December 16, 2025, more than a year after the attack was detected, PIH Health confirmed that patient information was present in files on the compromised parts of its network, and the files may have been accessed or acquired by the threat actor.

PIH Health said its detailed review of the affected data was time-intensive, hence the time taken to complete the review. After obtaining the full list of affected individuals in December 2025, PIH Health worked to gather contact information to allow notification letters to be mailed. That process was completed on February 25, 2026, and individuals affected by the breach are now learning that their data was compromised in the attack.

PIH Health said the types of data involved vary from individual to individual and, at the time of issuing notification letters, no evidence has been found of any misuse or attempted misuse of the affected information. The breach included personally identifiable information and protected health information such as names, addresses, medical information, health insurance information, Social Security numbers, taxpayer identification numbers, driver’s license numbers, financial account information, and credit/debit card numbers. PIH Health has offered the affected individuals complimentary credit monitoring and identity theft protection services, and has taken steps to minimize the risk of similar incidents occurring in the future.

What has yet to be confirmed is the scale of the data breach. While there has been a claim that 17 million records were stolen, that claim may have been exaggerated, and if the claim is correct, those records may not relate to unique patients. The data breach is not yet showing on the HHS’ Office for Civil Rights website, and the California Attorney General does not publish details about the scale of a data breach. Most of the affected individuals are likely to reside in California, but we have confirmed that the Texas Attorney General has been notified that 8,434 Texas residents were affected.

Last year, the HHS’ Office for Civil Rights announced that it had agreed to a $600,000 settlement with PIH Health to resolve potential HIPAA violations related to a 2020 phishing attack that affected 189,763 individuals. OCR determined that the HIPAA Security Rule had been violated as PIH Health failed to conduct a comprehensive and accurate risk analysis, as well as the HIPAA Breach Notification Rule, as PIH Health failed to issue timely notifications to OCR, the affected individuals, and the media.

December 16, 2024: Hackers Claim to Have Stolen 17 Million Patient Records from PIH Health

The hacking group behind the cyberattack on the Californian healthcare provider PIH Health on December 1, 2024, claims to have exfiltrated a huge amount of sensitive data before encrypting files. If the hackers are to be believed, they exfiltrated 17 million patient records.

Southern California News Group obtained a copy of a ransom note that had allegedly been faxed to PIH Health. The hackers claimed to have exfiltrated around 2 terabytes of sensitive data in the attack. The note states that the stolen data includes 17 million patient records, data for more than 8.1 million “medical episodes” that include patients’ home addresses, cancer patients’ treatment records, private emails including test results and treatments, confidentiality agreements with employees, and around 100 active nondisclosure agreements between PIH Health and other medical organizations. The hackers also provided a link where screenshots of the stolen data had been uploaded.

Southern California News Group said no hacking group had claimed responsibility for the attack. PIH Health was unable to verify the authenticity of the ransom note or the data theft claims. The PIH website notice states, “PIH Health is working with cyber forensic specialists to assess the issue. Impacted individuals will be notified if protected health information is found to be compromised.”

Multiple systems were taken offline as a result of the incident, and phone lines were also disrupted. The phone system used by PIH Health’s Good Samaritan Hospital in Los Angeles was unaffected, and lines from its Whittier and Downey hospitals have been rerouted there. While the attack has caused major disruption to its computer systems, staff are working on downtime procedures, and care continues to be provided to patients, with patient data recorded manually; however, staff members are struggling with the additional workload that this creates, and delays are being experienced by patients.

PIH Health updated its website FAQ about the incident on December 13, 2024, but was still not able to provide a timeline on when its systems are likely to be restored. PIH Health said local police departments have been notified, and the Federal Bureau of Investigation (FBI) has been engaged and is involved in the criminal investigation. PIH Health said it is doing everything possible to rectify the situation.

Hackers have been known to exaggerate the extent of data theft, and even if 17 million records were stolen, there may be duplicate records in the dataset. If it turns out that 17 million current and former patients have been affected, this would be the second-largest data breach of the year, behind the 100-million-record data breach at Change Healthcare in February.

The post PIH Health Notifies Patients About 2024 Hacking Incident appeared first on The HIPAA Journal.

Data breaches have recently been announced by two California medical groups – Valley Radiology Consultants Medical Group, which serves San Diego County, and Nephrology Associates Medical Group, which serves the Riverside and San Bernardino counties.

Valley Radiology Consultants Medical Group

Valley Radiology Consultants Medical Group in California has announced a security incident and data breach that was first identified on September 15, 2025. Immediate action was taken to secure its network, and third-party cybersecurity experts were engaged to determine the nature and scope of the unauthorized activity. The investigation confirmed unauthorized access to its network and files containing patient information. On February 18, 2026, the file review was concluded, and Valley Radiology Consultants Medical Group obtained the final list of individuals to notify.

There is currently no substitute data breach notice on its website, and the notice submitted to the California Attorney General has the types of data involved redacted. Individual notices include the types of information compromised in the incident. Valley Radiology Consultants Medical Group said it has changed passwords, enhanced systems security, and taken steps to reduce the risk of future harm. Notification letters are now being mailed, and the affected individuals have been offered complimentary single-bureau credit monitoring, credit report, and credit score services for 12 months. The incident is not yet shown on the HHS’ Office for Civil Rights data breach portal, so it is currently unclear how many individuals have been affected.

Nephrology Associates Medical Group

Nephrology Associates Medical Group in California has started notifying patients about a cyberattack and data breach that was first identified on May 20, 2025. Nephrology Associates Medical Group identified suspicious activity within its network and took immediate action to secure its systems and prevent further unauthorized access. Assisted by third-party cybersecurity experts, Nephrology Associates Medical Group confirmed that an unauthorized third party had accessed its network and exfiltrated files, including files containing patient information.

The file review has recently been completed, and Nephrology Associates Medical Group has confirmed that names, dates of birth, Social Security numbers, medical/health information, diagnoses, treatment information, health insurance information, billing/payment information, and credentialing information were involved. The impacted data varies from individual to individual. The substitute data breach notice makes no mention of credit monitoring and identity theft protection services.

Nephrology Associates Medical Group has taken several steps in response to the data breach to strengthen security, including enforcing stronger password requirements, mandating more frequent required password changes, reducing access permissions, and switching to offline storage of older data. The incident is not yet shown on the HHS’ Office for Civil Rights data breach portal, so it is currently unclear how many individuals have been affected.

The post Two California Medical Groups Announce Data Breaches appeared first on The HIPAA Journal.

Data breaches have been announced by Insight Hospital and Medical Center in Chicago and Community Health Action of Staten Island. BlueCross BlueShield of Tennessee has confirmed it was one of the healthcare organizations affected by the Conduent Business Services data breach.

Insight Hospital and Medical Center

Insight Hospital and Medical Center in Chicago has announced a data security incident that was first identified in September 2025.  Unusual activity was identified within its IT environment, and the forensic investigation confirmed unauthorized access to its network between August 22, 2025, and September 11, 2025.

The data review is ongoing to determine the individuals affected and the data involved; however, the likely information compromised in the incident may include names, dates of birth, Social Security numbers, passport numbers, financial account information, treatment-related information, and health insurance information. Notification letters will be mailed to the affected individuals when the data review is completed.

Two threat groups have claimed attacks on Insight Hospital and Medical Center. The LockBit5 group added the Chicago hospital and medical center to its data leak site on December 4, 2025, along with data allegedly stolen in the attack. LockBit claimed to have stolen “almost 200 gigabytes of medical secrets.” More recently, a group called Termite added Insight Hospital and Medical Center to its data leak site. Termite claims to have exfiltrated 360 GB of data in the attack and leaked the stolen data in late February 2026.

Community Health Action of Staten Island

Community Health Action of Staten Island, the operator of programs and social services for vulnerable individuals in Staten Island, New York, has notified certain individuals about a recent data security incident that may have involved unauthorized access and/or the theft of sensitive data.

The breach notice provided to the Massachusetts Attorney General on February 25, 2026, provides limited information about the incident, only confirming that names, Social Security numbers, driver’s license numbers/non-driver identification card numbers, bank account and routing numbers, medical information, and/or health insurance information were potentially impacted. The affected individuals have been offered complimentary credit monitoring and identity theft protection services for two years.

The nature of the incident was not disclosed in the letters, but this appears to have been a ransomware attack by the Genesis ransomware group, which added Community Health Action of Staten Island to its dark web data leak site. Genesis claims to have exfiltrated around 200,000 records containing sensitive personal and medical data, including approximately 60,000 records from HIV-tested patient databases, HIPAA-covered data, and employee information.

The incident has yet to appear on the HHS’ Office for Civil Rights breach portal, and Community Health Action of Staten Island has not confirmed how many individuals have been affected. The notice to the Massachusetts Attorney General only states that 2 state residents have been affected.

BlueCross BlueShield of Tennessee

BlueCross BlueShield of Tennessee has confirmed that some of its members have been affected by the data breach at business associate Conduent Business Services. The Conduent data breach is one of the largest healthcare data breaches ever discovered, with current figures indicating that more than 25 million individuals across the United States have been affected. A ransomware group gained access to its network on October 21, 2024, maintained access until January 13, 2025, exfiltrated data, and encrypted files.

Data compromised in the incident included name, Social Security number, medical information, and health insurance information. You can read more about the data breach in this post. BlueCross BlueShield of Tennessee reported the breach to the HHS’ Office for Civil Rights as affecting 1,670 members.

The post Insight Hospital and Medical Center Announces Cyberattack & Data Breach appeared first on The HIPAA Journal.

Data breaches have been announced by Apex Spine & Neurosurgery in Georgia and North Central Behavioral Health Systems in Illinois.

Apex Spine & Neurosurgery

Apex Spine & Neurosurgery in Georgia has notified 2,500 individuals that some of their electronic protected health information has likely been stolen in a ransomware attack. Apex Spine & Neurosurgery said it learned on December 23, 2025, that a cyber threat actor had accessed its network and used ransomware to encrypt files. The forensic investigation confirmed that the cyber actor accessed its network and copied files on December 9, 2025; however, its electronic medical record system was not involved, as it is maintained in a logically separate computer environment.

The stolen files are still being reviewed; however, they contained information such as names, addresses, phone numbers, dates of birth, Social Security numbers, driver’s license numbers, passport numbers, other government identifiers, location of health services, dates of service, treatment or condition information, diagnosis/diagnosis codes, prescription information, history information, assigned physician names; health services payment information, such as financial account number without a security code, access code, or password to access an account, patient account numbers, and health insurance information subscriber or identification numbers. The information copied in the attack varies from individual to individual. Apex Spine & Neurosurgery said it is evaluating further technical safeguards to better protect sensitive data on its network.

The affected individuals have been advised to remain vigilant against identity theft and fraud by monitoring their accounts and explanation of benefits statements for suspicious activity. While the ransomware group was not mentioned in the breach notice, the Interlock ransomware group claimed responsibility for the attack and said 20 GB of data was exfiltrated. Interlock proceeded to leak the stolen data as the ransom was not paid. Apex Spine & Neurosurgery said it was able to securely recover the encrypted data from backups.

North Central Behavioral Health Systems

North Central Behavioral Health Systems, a mental health and substance abuse treatment center with locations in La Salle and Ottawa, Illinois, has identified unauthorized access to an employee’s email account. Suspicious activity was identified in a single email account on or around December 2, 2025. The account was secured to prevent further unauthorized access, and an investigation was launched to determine the nature and scope of the activity.

The investigation confirmed that the breach was limited to a single email account. The account is currently being reviewed to determine the types of information involved and the individuals affected. Notification letters will be mailed to the affected individuals as soon as the review is concluded. Currently, no misuse of patient data has been identified; however, patients have been advised to remain vigilant against data misuse by monitoring their bank accounts and financial statements for suspicious activity. Email security has been enhanced in response to the incident, and complimentary credit monitoring and identity theft protection services are being offered to the affected individuals.

The post Apex Spine & Neurosurgery & North Central Behavioral Health Systems Announce Data Breaches appeared first on The HIPAA Journal.

Cyberattacks and data breaches have been announced by the healthcare providers Carolina Foot & Ankle Associates, New Age Dermatology, and Marin Cancer Care.

Carolina Foot & Ankle Associates

The North Carolina podiatry practice, Carolina Foot & Ankle Associates, is notifying patients that some of their personal and protected health information was exposed in a December 2025 cybersecurity incident. The incident was detected on December 8, 2025, when it experienced a network disruption. Third-party cybersecurity experts were engaged to investigate the incident and confirmed that an unauthorized third party had accessed its network and exfiltrated files containing patient data.

The file review has recently been completed, and confirmed that patient data had been compromised, including first and last names, phone numbers, dates of birth, medical record numbers, health insurance information, diagnostic/CPT codes, and dates of service. The types of data involved varied from individual to individual. Carolina Foot & Ankle Associates said Social Security numbers and financial information were not compromised in the incident, and there was no unauthorized access to its electronic medical record system.

When the breach was detected, immediate enhancements were made to security to prevent further data security incidents, and law enforcement was notified. As a precaution against data misuse, the affected individuals have been offered complimentary credit monitoring and identity theft protection services. The breach has been reported to the HHS’ Office for Civil Rights using a placeholder estimate of at least 501 affected individuals.

New Age Dermatology

New Age Dermatology LLC has notified the Massachusetts Attorney General about a ransomware attack that was identified on or around December 20, 2025. According to the notice, the ransomware attack affected an internal server, which has been rendered inoperable and inaccessible.  Law enforcement has been notified, and an investigation has been launched, with assistance provided by third-party cybersecurity professionals.

At this stage of the investigation, New Age Dermatology has yet to determine the specific types of information involved or the number of individuals affected, but explained that information likely compromised in the incident includes personal and protected health information typically found in patient records, including names, dates of birth, medial and treatment information, diagnostic images, photographs, and Social Security numbers may have been compromised. New Age Dermatology has found no evidence to suggest that its electronic medical record system was compromised in the incident. At the time of writing, no ransomware group appears to have claimed responsibility for the attack.

New Age Dermatology is unaware of any data misuse, but as a precaution, the affected individuals have been offered complimentary credit monitoring and identity theft protection services for 12 months.

Marin Cancer Care

Marin Cancer Care, a provider of cancer treatment in Larkspur, California, has alerted patients to an incident involving unauthorized access to its computer network. An intrusion was detected on or around December 8, 2025, and assisted by third-party investigators, Marin Cancer Center learned that an unauthorized third party had access to its computer network between November 22, 2025, and December 6, 2025, during which time files containing patient information may have been viewed or acquired.

The investigation and file review are ongoing to determine the affected individuals and the types of information involved. Marin Cancer Care has confirmed that names, medical information, and health insurance information were likely involved. Patients have been advised to remain vigilant against incidents of identity theft and fraud by reviewing their account statements and monitoring their free credit reports for suspicious activity.

The post Carolina Foot & Ankle Associates Notifies Patients About December 2025 Cyberattack appeared first on The HIPAA Journal.