Data breaches have been announced by Cognitive Health Technologies in New York, City Ambulance Service in Texas, Baraga County Memorial Hospital in Michigan, The Speech Clinic in Georgia, and Innovative Alternatives in Texas.
Cognitive Health Technologies, New York
Cognitive Health Technologies LLC, a New York-based healthcare technology and IT consulting company, has disclosed a data security incident involving the protected health information of 49,467 individuals. According to its substitute data breach notice, suspicious network activity was identified on April 27, 2026. A forensic investigation was initiated to determine the nature and scope of the activity, which confirmed that its network had been accessed by an unauthorized third party between February 5, 2026, and April 28, 2026. During that time, there was unauthorized access and acquisition of files and folders containing protected health information.
The data review confirmed that the information compromised in the incident included names, dates of birth, health insurance information, medical histories, and treatment information. While patient data was compromised in the incident, no misuse of that information has been identified. Cognitive Health Technologies said it has reviewed its security policies and has implemented additional measures to protect against similar incidents in the future.
Viking Enterprises (City Ambulance Service), Texas
Viking Enterprises, doing business as City Ambulance Service in Spring, Texas, has notified the HHS Office for Civil Rights about a hacking incident affecting 14,324 individuals. The breach was reported to OCR on August 31, 2026, as an email-related incident. Little information has been released about the incident, although based on the report submitted to the Texas Attorney General, the compromised data includes names, addresses, dates of birth, medical information, health insurance information, and Social Security numbers.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
@media only screen and (min-width: 961px) {
.inpage_mobile {
display: none;
}
.inpage_banner_12838 {
margin-bottom: 18px;
}
.inpage_banner_12838 a {
max-width: 80%;
display: block;
margin: 0 auto;
}
}
@media only screen and (max-width: 960px) {
.inpage_desktop { display: none; }
}
.hj_co_m_12838 {
margin-bottom: 30px;
}
.hj_co_m_12838 .sbwf-main-form-container {
max-width: 340px;
margin: 0 auto;
box-shadow: 0 4px 6px rgba(0,0,0,0.05),0 6px 6px rgba(0,0,0,0.05);
padding: 30px;
box-sizing: border-box;
border: 1px solid #f4f4f4;
}
.hj_co_m_12838 .sbwf-main-form-container img {
max-width: 200px;
margin: 0 auto;
display: block;
}
.hj_co_m_12838 .sbwf-main-form-container p.cl_title1,
article.entry-content .lp-main .lp-main-content .hj_co_m_12838 .sbwf-main-form-container p.cl_title1 {
text-align: center;
border-top: 1px dashed #c8c8c8;
padding: 20px 0 0;
margin: 30px 0 20px;
color: #753043;
font-weight: 600;
line-height: 30px;
}
.hj_co_m_12838 .sbwf-main-form-container p.cl_title2,
article.entry-content .lp-main .lp-main-content .hj_co_m_12838 .sbwf-main-form-container p.cl_title2 {
text-align: center;
font-size: 16px;
color: #3B3B3B;
line-height: 24px;
font-weight: 600;
margin: 0;
padding: 0;
}
#sidebar .sbwf-main-form-container p.cl_title1 span {
font-weight: 700;
color: #000;
padding-top: 4px;
display: block;
line-height: 34px;
}
.hj_co_m_12838 .sbwf-main-form-container p.cl_title2 span {
font-weight: 600;
}
.hj_co_m_12838 .sbwf-main-form-container p.terms,
article.entry-content .lp-main .lp-main-content .hj_co_m_12838 .sbwf-main-form-container p.terms {
text-align: center;
font-size: 11px;
padding-bottom: 0;
line-height: 19px;
margin: 10px 0 10px;
}
.hj_co_m_12838 .sbwf-main-form-container p.terms a {
color: #753044;
text-decoration: none;
}
.hj_co_m_12838 .sbwf-main-form-container p.terms a:hover {
text-decoration: underline;
}
.hj_co_m_12838 .sbwf-main-form-container p.terms_title,
article.entry-content .lp-main .lp-main-content .hj_co_m_12838 .sbwf-main-form-container p.terms_title {
text-align: center;
font-size: 11px;
font-weight: 600;
color: #752f43;
padding-bottom: 0;
line-height: 19px;
}
.hj_co_m_12838 .sbwf-main-form-container p.info,
article.entry-content .lp-main .lp-main-content .hj_co_m_12838 .sbwf-main-form-container p.info {
text-align: center;
color: #727272;
font-size: 14px;
line-height: 20px;
padding-bottom: 20px;
}
.hj_co_m_12838 .sbwf-main-form-container div.wpforms-container-full .wpforms-form input.wpforms-field-medium {
width: 100%;
max-width: 100%;
}
.hj_co_m_12838 .sbwf-main-form-container div.wpforms-container-full .wpforms-form .wpforms-field {
padding-top: 0;
}
.hj_co_m_12838 .sbwf-main-form-container div.wpforms-container-full .wpforms-form input[type="text"],
.hj_co_m_12838 .sbwf-main-form-container div.wpforms-container-full .wpforms-form input[type="email"],
.hj_co_m_12838 .sbwf-main-form-container div.wpforms-container-full .wpforms-form input[type="tel"] {
border: 2px solid #f4f3f3;
font-size: 14px;
}
.hj_co_m_12838 .sbwf-main-form-container div.wpforms-container-full {
margin: 24px 0;
}
.hj_co_m_12838 .sbwf-main-form-container div.wpforms-container-full .wpforms-form button[type="submit"] {
border: 0;
color: #fff;
margin: 0 auto;
display: flex;
align-items: center;
justify-content: center;
box-sizing: border-box;
padding: 0 65px 0 30px;
background-image: url(https://www.hipaajournal.com/wp-content/uploads/2026/08/btn.png);
background-color: unset;
background-size: cover;
background-repeat: no-repeat;
width: 260px;
height: 61px;
font-size: 16px;
font-weight: 600;
}
.hj_co_m_12838 .sbwf-main-form-container div.wpforms-container-full .wpforms-form button[type="submit"]:hover {
background-image: url(https://www.hipaajournal.com/wp-content/uploads/2026/08/btn_hover.png);
background-color: unset;
border: 0;
}
.hj_co_m_12838 .sbwf-main-form-container {
padding: 20px;
}
.hj_co_m_12838 .sbwf-main-form-container img {
max-width: 170px;
}
.hj_co_m_12838 .sbwf-main-form-container p.cl_title1,
article.entry-content .lp-main .lp-main-content .hj_co_m_12838 .sbwf-main-form-container p.cl_title1 {
font-size: 22px;
line-height: 28px;
}
.hj_co_m_12838 .sbwf-main-form-container p.cl_title1 span {
font-weight: 700;
color: #000;
padding-top: 4px;
display: block;
line-height: 34px;
}
.hj_co_m_12838 .sbwf-main-form-container p.cl_title2,
article.entry-content .lp-main .lp-main-content .hj_co_m_12838 .sbwf-main-form-container p.cl_title2 {
font-size: 18px;
line-height: 24px;
}
.hj_co_m_12838 div.wpforms-container-full .wpforms-form input.wpforms-field-medium[type="text"],
.hj_co_m_12838 div.wpforms-container-full .wpforms-form input.wpforms-field-medium[type="email"],
.hj_co_m_12838 div.wpforms-container-full .wpforms-form input.wpforms-field-medium[type="tel"] {
height: 36px;
}
.hj_co_m_12838 .sbwf-main-form-container div.wpforms-container-full .wpforms-form button[type="submit"] {
border: 0;
color: #fff;
margin: 0 auto;
display: flex;
align-items: center;
justify-content: center;
box-sizing: border-box;
padding: 0 65px 0 30px;
background-image: url(https://www.hipaajournal.com/wp-content/uploads/2026/08/btn.png);
background-color: unset;
background-size: cover;
background-repeat: no-repeat;
width: 220px;
height: 52px;
font-size: 15px;
font-weight: 600;
}
.hj_co_m_12838 .sbwf-main-form-container div.wpforms-container-full .wpforms-form button[type="submit"]:hover {
background-image: url(https://www.hipaajournal.com/wp-content/uploads/2026/08/btn_hover.png);
background-color: unset;
border: 0;
}
.hj_sb_m_12838 div.wpforms-container-full .wpforms-form .wpforms-field-row.wpforms-field-medium {
max-width: 100%;
}
form[data-zi-mapped-form] #wpforms-28160-field_1,
form[data-zi-mapped-form] #wpforms-28160-field_1-last,
form[data-zi-mapped-form] #wpforms-28160-field_3-container,
form[data-zi-mapped-form] #wpforms-28160-field_6-container {
display: none;
}
form[data-zi-mapped-form] #wpforms-28160-field_1[data-zi-input-enriched="false"],
form[data-zi-mapped-form] #wpforms-28160-field_1-last[data-zi-input-enriched="false"],
form[data-zi-mapped-form] #wpforms-28160-field_3-container[data-zi-field-enriched="false"],
form[data-zi-mapped-form] #wpforms-28160-field_6-container[data-zi-field-enriched="false"] {
display: block !important;
}
form[data-zi-mapped-form] #wpforms-28155-field_1,
form[data-zi-mapped-form] #wpforms-28155-field_1-last,
form[data-zi-mapped-form] #wpforms-28155-field_3-container,
form[data-zi-mapped-form] #wpforms-28155-field_6-container {
display: none;
}
form[data-zi-mapped-form] #wpforms-28155-field_1[data-zi-input-enriched="false"],
form[data-zi-mapped-form] #wpforms-28155-field_1-last[data-zi-input-enriched="false"],
form[data-zi-mapped-form] #wpforms-28155-field_3-container[data-zi-field-enriched="false"],
form[data-zi-mapped-form] #wpforms-28155-field_6-container[data-zi-field-enriched="false"] {
display: block !important;
}
The Qilin ransomware and data theft/extortion group claimed responsibility for the attack and maintains that sensitive data was stolen. It is unclear if ransomware was used in the attack. The July 19, 2026, listing on its dark web data leak site states that 14 GB of data was exfiltrated, and the stolen data has been published. The HIPAA Journal has not downloaded any of the data, so it cannot verify the claim; however, the screenshots uploaded as proof of compromise include some patient data.
Baraga County Memorial Hospital, Michigan
Baraga County Memorial Hospital in L’Anse, Michigan, has reported a data breach to the HHS’ Office for Civil Rights that involved unauthorized access to systems containing the protected health information of patients. At the time of publication, the number of affected individuals has yet to be determined. The breach has been reported using a placeholder figure of at least 501 affected individuals.
The hospital has not yet disclosed details of the incident or the information involved, other than the report to OCR that states this was a hacking/IT incident. A cybercriminal group claimed responsibility for the incident on July 4, 2026. The Wallstreet ransomware group added Baraga County Memorial Hospital to its dark web data leak site and claims to have exfiltrated data in the attack. The group leaked the stolen data when the ransom was not paid.
Innovative Alternatives, Texas
Innovative Alternatives, Inc., a Houston, Texas-based nonprofit mental health and counselling service provider, has disclosed a data security incident involving the personal and protected health information of approximately 1,500 current and former clients, employees, and donors. On August 2, 2026, Innovative Alternatives learned that a criminal cyber actor had accessed its network and used ransomware to encrypt files. Third-party cybersecurity and digital forensics experts were engaged to investigate the incident, and it was confirmed that data was accessed and may have been acquired. The electronic medical record system was not involved.
The data review confirmed that the compromised information included names, contact information, clinical counselling notes, and, for employees, contact and employment information. Innovative Alternatives has changed all system and user passwords, conducted additional security scans, and worked with third-party cybersecurity experts to strengthen its security measures to reduce the risk of similar incidents in the future. Notification letters were mailed to the affected individuals on October 2, 2026.
The Speech Clinic, Georgia
The Speech Clinic, a Waycross, Georgia-based speech-language pathology, occupational therapy, and physical therapy service provider, has experienced a data security incident. On August 10, 2026, the practice began experiencing difficulties accessing a computer at its Waycross location. The forensic investigation confirmed on August 17, 2026, that the computer had been remotely accessed by an unauthorized third party, as well as an older server containing pre-2017 patient records of 2,168 patients.
The forensic investigation could not confirm whether patient data was accessed, but unauthorized access could not be ruled out. For some patients, only their name was exposed, while others had a combination of name, date of birth, Social Security number, diagnosis, and other medical information.
The post Cognitive Health Technologies Data Breach Affects 49,500 Individuals appeared first on The HIPAA Journal.
