Five small healthcare organizations have recently announced that they have experienced security incidents exposing patient data: Family Medical Associates of Raleigh; Arkansas Oral & Maxillofacial Surgeons; Alpine Agency of the Midlands; Princeton Family Eye Care; and James C. Standring, DDS.

Family Medical Associates of Raleigh, North Carolina

Family Medical Associates of Raleigh, a multi-provider family medical practice in Raleigh, North Carolina, identified a potential cybersecurity incident on May 7, 2026, and activated its incident response protocol. Steps were immediately taken to investigate, contain, and remediate the incident; law enforcement was notified, and third-party cybersecurity professionals were engaged. The investigation and data review are ongoing; however, it has been confirmed that certain systems were intermittently accessed by an unauthorized third party between April 18, 2026, and April 20, 2026, who potentially downloaded internal data, including files containing patients’ protected health information.

The data review has not yet been completed, but the types of data exposed in the incident include names, demographic information, contact information, medical and treatment information, health insurance information, financial/payment-related information, government-issued ID numbers, and other data related to the medical services provided. Family Medical Associates of Raleigh said it is unaware of any actual or attempted misuse of patient data as a result of the incident; however, patients have been advised to remain vigilant against identity theft and fraud by monitoring their accounts, free credit reports, and explanation of benefits statements.

Since the investigation has yet to conclude, the number of affected individuals is currently unknown. While the name of the threat actor behind the attack was not disclosed, the Genesis ransomware group claimed responsibility for the attack.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Arkansas Oral & Maxillofacial Surgeons, Arkansas

Arkansas Oral & Maxillofacial Surgeons, a Hot Springs, Arkansas-based provider of oral surgery, dental implants, and other dental and cosmetic dentistry services, has announced a data security incident that was first identified on April 7, 2026.

An investigation was initiated, and on June 2, 2026, it was confirmed that an unauthorized third party had accessed its network and exfiltrated files containing patient information. The files have been reviewed and were found to contain information such as names, contact information, birth dates, medical record numbers, government identification numbers (including Social Security numbers), diagnoses, treatment records, health insurance information, prescription histories, and payment information.

The affected individuals have been notified by mail and provided with recommendations on how to protect themselves against data misuse. Based on the substitute breach notice on the Arkansas Oral & Maxillofacial Surgeons website, credit monitoring and identity theft protection services do not appear to have been offered. The incident is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is unclear how many patients have been affected.

This appears to have been a data theft and extortion attempt. The PEAR threat group claimed responsibility. PEAR does not encrypt files, as the group engages in data theft and extortion, threatening to publish stolen data if the ransom is not paid.

Alpine Agency of the Midlands, South Carolina

Alpine Agency of the Midlands, LLC, a small, independent health and benefits insurance company based in Columbia, South Carolina, has recently disclosed a security incident involving unauthorized access to its email system. Alpine provides services to insurance carriers, employers, and health plans, and is provided with certain health data by its clients in connection with the services it provides.

Unusual activity was identified within an employee email account in November 2025. The account was secured, and an investigation was launched to determine the nature and scope of the unauthorized activity. The investigation confirmed that the incident affected a single email account, which was first accessed by an unauthorized third party on October 28, 2026. Emails and associated attachments may have been copied by the attacker.

The account was reviewed and found to contain first and last names, addresses, dates of birth, health insurance information, and limited Social Security numbers. Notifications will be mailed to the affected individuals when the review is completed. In the meantime, the breach has been reported to the HHS’ Office for Civil Rights as affecting at least 500 individuals. The total will be updated when the file review is concluded.

Princeton Family Eye Care, Texas

Princeton Family Eye Care, a small optometry practice in Princeton, Texas, has notified certain patients about a recent data breach. On May 4, 2026, suspicious activity was identified within its email environment. Assisted by third-party cybersecurity experts, the practice secured its email systems, investigated the activity, and confirmed that a company email account had been accessed by an unauthorized third party.

A data review firm was engaged to determine the types of data involved and the individuals affected, and that process has recently been completed. The data exposed in the incident varied from individual to individual and may have included names in combination with one or more of the following: date of birth, contact information, government identification numbers (such as a driver’s license, passport, or Social Security number), and limited medical information (such as treatment details, health insurance records, or a medical record number).

No misuse of the affected information has been identified; however, the affected patients have been advised to remain vigilant against misuse of their information. The breach was reported to the Texas Attorney General as involving the data of 933 Texas residents.

James C. Standring, DDS, California

James C. Standring, DDS, a dental practice in Crescent City, California, has notified 6,658 patients about a data security incident involving unauthorized access to its computer systems. While the data breach was reported to the HHS’ Office for Civil Rights on July 17, 2026, this appears to have been a historical data breach.

According to the breach explanation on the dental practice website, unauthorized access to certain computer systems was first identified on September 2, 2024. Assisted by third-party cybersecurity specialists, the practice determined that the incident resulted in the exposure of the data of current and former patients, including names, addresses, email addresses, Social Security numbers, driver’s license/state ID numbers, medical information, health insurance information, financial account/payment card information, and other personal information maintained by the practice.

No misuse of the affected data has been identified; however, patients have been advised to remain vigilant against identity theft and fraud. No explanation was provided about why it took 22 months from the date of discovery to issue notification letters.

The post Data Breaches Announced by Five Small Healthcare Organizations appeared first on The HIPAA Journal.

A vishing attack on Sunshine Health, a Florida-based Medicaid and health insurance agency, involved the theft of the PHI of more than 41,000 individuals. Health Payment Systems, a Wisconsin healthcare billing company, has experienced an email security incident affecting more than 8,000 patients.

Sunshine Health

Sunshine Health, a Broward County, Florida-based Medicaid and health insurance agency, has recently discovered a vishing incident involving the impermissible disclosure of the protected health information of 41,569 individuals.

Vishing, or voice phishing, takes place over the phone and involves tricking an individual into providing the attacker with access to their device or sensitive information. In this case, an employee was tricked into sharing a limited number of health plan files by a caller pretending to be a trusted individual. The incident occurred on May 6, 2026, and was identified the same day. An investigation was launched, and the shared files were reviewed and were found to include names, dates of birth, medical information/histories, and health plan coverage information.

Sunshine Health said it has not found any evidence to suggest that the disclosed information has been misused at this time; however, to protect against data misuse, the affected individuals have been offered complimentary credit monitoring and identity theft protection services. Additional training has been provided to the workforce to raise awareness of the techniques that threat actors may use to gain access to internal systems and sensitive data.

Health Payment Systems

Health Payment Systems, Inc., a Wisconsin-based healthcare technology and billing software company, has notified the HHS’ Office for Civil Rights about a breach of the protected health information of 9,380 individuals.

On or around June 27, 2025, the company identified suspicious activity within its email environment. Immediate action was taken to secure the accounts and prevent further unauthorized access, and an investigation was launched to determine the nature and scope of the incident. Assisted by third-party cybersecurity specialists, Health Payment Systems confirmed that certain employee email accounts had been accessed by an unauthorized third party between June 24, 2025, and June 27, 2025, and certain emails were copied.

It has taken more than a year to investigate the incident and review the affected data. The HHS’ Office for Civil Rights was informed about the data breach on July 10, 2026, and notification letters are now being mailed to the affected individuals. Data exposed in the incident included names, addresses, birth dates, IDs, subscription IDs, and subscriber person IDs. For certain individuals, medical information, health insurance information, and Social Security numbers were also involved.

The affected individuals have been offered complimentary credit monitoring and identity theft protection services, and have been advised to monitor their explanation of benefits statements and account statements for signs of data misuse. Health Payment Systems said it has strengthened its security policies and has implemented additional cybersecurity measures to prevent similar incidents in the future.

The post Data Breaches Reported by Sunshine Health; Health Payment Systems appeared first on The HIPAA Journal.

Data security incidents have recently been announced by Loma Linda University Health and UCLA Health.

Loma Linda University Health

Loma Linda University Health has recently announced a data breach involving an external AI platform. The incident involved patient information from an Institutional Review Board-approved research study. During the course of the study, A dataset including limited patient information was inadvertently uploaded to an AI platform.

When the incident was identified, an investigation was launched to determine the extent of data exposure. The investigation determined that the dataset included medical record numbers, dates of birth, and limited clinical information related to orthopedic care.  The breach did not include complete treatment records, nor Social Security numbers, financial information, or insurance information.

The academic medical center said it takes the privacy and security of patient information seriously and is reviewing its policies, procedures, and workforce training on the use of external technologies such as AI platforms. The number of affected individuals has yet to be publicly disclosed.

UCLA Health

UCLA Health is notifying an unspecified number of patients about an improper disclosure of some of their personal and protected health information. According to the breach notice provided to the California Attorney General, UCLA Health determined on July 2, 2026, that patient information was accessed and disclosed to an outside healthcare provider in a manner inconsistent with its HIPAA policies.

The notice indicates that the disclosures occurred between December 27, 2024, and April 21, 2026. The investigation confirmed that the information involved was limited to names, dates of birth, health insurance information, and clinical information, such as referral orders. For a limited number of individuals, the last four digits of their Social Security numbers were also included.

UCLA Health said it has implemented additional measures to prevent similar breaches in the future, including enhanced system controls and increased monitoring. UCLA Health said it is unaware of any actual or attempted misuse of patient data as a result of the incident.

The post Data Breaches Announced by Loma Linda University Health & UCLA Health appeared first on The HIPAA Journal.

Lifespan Physicians Group of Massachusetts, doing business as Brown Health Medical Group-MA, has confirmed that the protected health information of almost 312,000 individuals was potentially compromised in a December 2025 security incident.

There is currently no substitute breach notice on the medical group’s website; however, the data breach was reported to the Vermont and Massachusetts Attorneys General. The breach notices issued to those regulators explain that unauthorized activity was identified in a legacy file server at the practice on December 16, 2025. The server was isolated, and an investigation was launched to determine the nature and scope of the unauthorized activity. The forensic investigation confirmed that the breach was limited to the file server, which was accessed by an unauthorized third party between December 15 and December 16, 2026. The electronic medical record system was not involved.

The server was reviewed to determine the exact types of information stored on the server. The file review determined on June 22, 2026, that the following categories of data were impacted – names, dates of birth, contact information, Social Security numbers, driver’s license numbers or other government-issued identification numbers, credit or debit card numbers, financial account information, and personnel and human resources records. The latter may have included information such as compensation or payroll information, licensure or credentialing information, and medical or disability-related records.

Steps have been taken to improve security to prevent similar incidents in the future, including implementing enhanced technical safeguards. The affected individuals have been offered complimentary credit monitoring and identity theft protection services for 24 months. The incident affected 290,357 Massachusetts residents and 86 Vermont residents. According to the HHS’ Office for Civil Rights data breach portal, the protected health information of 311,760 individuals was potentially stolen in the incident.

The post Brown Health Medical Group-MA Data Breach Affects 312,000 Individuals appeared first on The HIPAA Journal.

Amgen Inc., a Thousand Oaks, CA-based biopharmaceutical company that develops and manufactures pharmaceutical products for oncological, hematological, and cardiovascular diseases, has recently disclosed a cybersecurity incident involving unauthorized access to third-party-hosted cloud storage systems.

In a Form 8-K filing with the U.S. Securities and Exchange Commission (SEC), Amgen explained that it determined in July 2026 that hackers gained access to certain cloud systems. Amgen immediately implemented its cybersecurity response plan, deployed containment measures, and engaged third-party digital forensics experts to determine the nature and scope of the unauthorized activity.

The investigation determined that proprietary data, patients’ protected health information, and other data had been exfiltrated from the cloud environment, and on July 29, 2026, determined that the incident was material and informed the SEC. Amgen said it does not believe the incident is reasonably likely to have an impact on its financial position, nor any of its products, manufacturing operations, financial reporting systems, or its ability to meet patient needs.

Amgen is in the process of assessing the extent to which patient information, confidential business information, intellectual property, research and development, and other information was exfiltrated in the attack and will be unable to accurately determine the impact to the company until those processes have concluded. At present, the exact nature of the attack, such as how the cloud systems were compromised, has yet to be made public. Amgen said it takes the protection of its systems and data very seriously and is in the process of determining the applicable regulatory and legal notification requirements, including its responsibilities under HIPAA.

As of the date of the SEC filing, the threat group behind the attack is unclear. Several pharmaceutical, biotechnology, and medtech firms have fallen victim to cyberattacks in recent months, including Novo Nordisk, Medtronic, Stryker, Abbott Laboratories, West Pharmaceutical Services, and Brainyx AI. The attacks have been conducted by several threat actors, including the Iran-linked hacktivist group Handala and the data theft and extortion groups FulcrumSec and ShinyHunters. The latter was the subject of a recent cybersecurity alert by Health-ISAC after a string of successful hacks on the healthcare sector.

The post AmGen Announces Cyberattack and Data Breach Involving Patient Data appeared first on The HIPAA Journal.

Data breaches have been announced by Soniva Dental Care in Texas, Optalis Management Solutions in Michigan, CareCloud in New Jersey, and Hudson Valley Medical Billing & Credentialing in New York.

Soniva Dental Care

Soniva Dental Care, a San Antonio, Texas-headquartered provider of dental services, orthodontics, and cosmetic dentistry across 14 locations, has recently disclosed a cybersecurity incident affecting patients of several of its practices. On May 26, 2026, Soniva Dental Care was informed by its IT support company about suspicious remote access sessions. It rapidly became apparent that its remote desktop web services infrastructure was under attack, and IT resources were shifted to containing the incident, terminating all external communications, disabling accounts with remote desktop access, and locking down its infrastructure. Soniva Dental Care said its patient record system was quickly restored and its archive data was unaffected.

While the incident was rapidly detected and contained, it was not possible to rule out unauthorized access to patient data. Files exposed in the incident were reviewed and found to contain names, addresses, dates of birth, driver’s license numbers, government-issued IDs, and medical information. Soniva Dental Care said its incident response was effective, and it has not identified any further suspicious activity. While Soniva Dental Care is unaware of any instances of data misuse, the affected individuals have been advised to place a fraud alert on their accounts with any of the three major credit bureaus. Security inspections are being conducted by its IT support company, which will continue to monitor for unauthorized activity.

Regulators have been notified about the data breach, but the incident is not yet shown on the HHS Office for Civil Rights breach portal. The Texas Attorney General was informed that up to 30,000 Texas residents were potentially affected. Affected practices include, but may not be limited to, Agave Dental Floresville, Allwyn Dental, Azle Smiles, Kashi Dental, Mysa Dental, and Wilson Dental.

A ransomware-as-a-service group called TheGentlemen claimed responsibility for the attack. The group is currently one of the most prolific ransomware groups, having attracted affiliates from other groups by offering a 90% split on ransom payments.

Optalis Management Solutions

Optalis Management Solutions, a Michigan-based operations management company specializing in the management of senior living and healthcare facilities, has reported a data breach to the HHS Office for Civil Rights involving the protected health information of 13,723 individuals.

Suspicious activity was identified within its computer network on or around April 19, 2025. The forensic investigation confirmed unauthorized access between April 14, 2025, and April 19, 2025, and on June 10, 2025, it was confirmed that files had been exfiltrated from its network. The review of the affected data has recently been completed, confirming that the following types of information were compromised in the incident: full names, Social Security numbers, driver’s license/state ID numbers, credit/debit card information, financial account information, diagnosis and treatment information, and health insurance information.

Notification letters started to be mailed to the affected individuals on June 29, 2026. While no evidence has been found to indicate any actual or attempted misuse of the stolen data, individuals whose Social Security numbers were involved have been offered complimentary credit monitoring and identity theft protection services.

CareCloud

CareCloud Inc., a Somerset, New Jersey-based provider of cloud-based and AI-powered EHR, RCM, PM, and clinical documentation solutions, has determined that data was exfiltrated from its systems in a recent security incident. CareCloud said it experienced a network disruption on March 16, 2026, that impacted one of its electronic health record environments. Third-party cybersecurity experts were engaged to assist with the investigation, who determined that the impacted AWS environment was accessed by an unauthorized third party between March 10 and March 16, 2026. The threat actor claimed to have exfiltrated databases from that environment.

The data was reviewed, and on June 24, 2026, CareCloud confirmed the data types involved. The affected individuals are now being notified, and the individual notification letters state the exact types of data involved. Complimentary identity theft protection services have been offered to the affected individuals. The data breach is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

Hudson Valley Medical Billing & Credentialing

Hudson Valley Medical Billing & Credentialing, LLC, a New York-based provider of patient billing and accounts receivable services, has identified unauthorized access to computer systems containing the protected health information of 5,459 patients of its healthcare clients. The intrusion was first identified on March 6, 2026, and immediate action was taken to contain the incident and terminate the unauthorized access. The investigation was unable to determine whether patient data was accessed or copied, so notification letters have been mailed to individuals who have potentially been affected.

The company said it has enhanced its technical safeguards to strengthen system security, and the affected individuals have been offered complimentary credit monitoring and identity theft protection services. The exact data types involved are detailed in the individual notification letters.

The post Soniva Dental Care Data Breach Affects At Least 30,000 Patients appeared first on The HIPAA Journal.

Operation PAR, a Florida-based SUD treatment provider, has announced a data breach affecting more than 145,700 individuals. Data breaches have also been announced by Vanderbilt Health in Tennessee, Averhealth Holdings in Virginia, and the Texas-based nationwide optical and optometric service provider Eyemart Express.

Operation PAR, Florida

Operation PAR, Inc., a Pinellas Park, Florida-based addiction treatment and mental health service provider, has identified unauthorized access to its computer network and the exposure of the protected health information of 145,714 current and former clients. Suspicious activity was identified within its computer network on June 10, 2025. Immediate steps were taken to secure its systems, and an investigation was launched to determine the nature and scope of the activity.

A year to the day after the incident was identified, Operation PAR confirmed that the impacted files contained personal and protected health information. Data compromised in the incident included first and last names, dates of birth, Social Security numbers, driver’s license numbers, financial account information, medical information, and health insurance information. Steps have since been taken to augment security and prevent similar incidents in the future.

Notification letters started to be mailed to the affected individuals on June 25, 2026, who were provided with information on best practices to protect their information and prevent fraud and misuse. Credit monitoring and identity theft protection services do not appear to have been offered. While not stated in the notification letters, this appears to have been an attack by the Worldleaks threat group, which added Operation PAR to its dark web data leak site in July 2025. The group proceeded to leak the stolen data.

Eyemart Express, Texas

Farmers Branch, Texas-based Eyemart Express, a nationwide provider of optical and optometric services, has disclosed further information about a data breach reported to the HHS’ Office for Civil Rights on May 18, 2026. Unauthorized access to parts of the Eyemart Express network was discovered on February 13, 2026. Immediate action was taken to secure its network, and an investigation was launched to determine the nature and scope of the unauthorized activity.

The investigation confirmed that an unauthorized third party breached its network the previous day (February 12, 2026), and gained access to files containing names, addresses, dates of birth, Social Security numbers, prescription information, insurance information, and information about eyeglass purchases. Eyemart Express has reviewed its policies and procedures related to data security and is implementing additional measures to reduce the risk of similar incidents in the future. The protected health information of up to 25,000 individuals was potentially compromised in the incident. Individuals who had their Social Security numbers exposed have been offered complimentary credit monitoring and identity theft protection services.

While not stated in the breach notice, this was a cyberattack by the PayoutsKing threat group. The threat group claimed to have exfiltrated 435 GB of data in the attack, including customer and employee information. The group proceeded to leak the stolen data when the ransom was not paid.

Vanderbilt Health, Tennessee

Nashville, Tennessee-based Vanderbilt Health, the operator of 8 hospitals and more than 180 ambulatory, primary care, and specialty clinics in the state, has identified unauthorized access to an employee’s email account. An employee was tricked by a phishing attempt into clicking a malicious link, resulting in the theft of their credentials. Unauthorized account access was detected on March 27, 2026, and the forensic investigation confirmed that the account was compromised on March 23, 2026. An unauthorized individual had access to emails and associated documents containing patient information such as names, medical record numbers, diagnoses, procedure information, provider/facility names, and admission, discharge, and visit dates.

The breach was confined to the email account. There was no unauthorized access to electronic medical records, and financial information and Social Security numbers were not involved. In response to the incident, Vanderbilt Health is enhancing its email and digital security measures and has provided additional security awareness training to the workforce. The number of affected individuals has yet to be publicly disclosed.

Averhealth Holdings, Virginia

Averhealth Holdings, the parent company of Avertest, a provider of drug testing services for substance use monitoring, diagnostic laboratory testing, and random drug-testing programs, has notified the HHS’ Office for Civil Rights about a breach of the protected health information of 9,909 individuals.

Suspicious activity was identified within its email environment on January 20, 2026. Steps were taken to contain the incident, and an investigation was launched to determine the nature and scope of the activity, with assistance provided by third-party cybersecurity professionals. The investigation determined that there had been unauthorized access to parts of its network between December 19, 2025, and January 21, 2026. On May 6, 2026, Averhealth Holdings discovered that the threat actor behind the attack had obtained files containing personal information and protected health information.

The types of information varied from individual to individual and included names in combination with one or more of the following: clinical information, diagnosis, digital/electronic signature, date of birth, driver’s license number, health insurance policy-related number, medical cost, medical dates of service, medical history, medical provider name, medical record number, medical treatment/procedure information, mental or physical condition, minor, patient account number, and/or Social Security number.

Notification letters were mailed to the affected individuals on July 2, 2026. At the time of issuing notifications, Averhealth Holdings was unaware of any misuse of the impacted information. As a precaution against data misuse, complimentary credit monitoring services have been offered to individuals who had their Social Security numbers exposed or stolen.

The post Florida SUD Treatment Provider Announces 145,700-record Data Breach appeared first on The HIPAA Journal.