Issaqueena Pediatric Dentistry in South Carolina, Enhabit Home Health & Hospice in Texas, and AltaMed Health Services in California have announced that patient data has potentially been compromised in ransomware attacks.

Issaqueena Pediatric Dentistry, South Carolina

Issaqueena Pediatric Dentistry in Seneca, South Carolina, has recently reported a hacking incident to the HHS’ Office for Civil Rights that involved unauthorized access to personally identifiable information and protected health information. The incident is still being investigated, so the number of affected individuals has yet to be confirmed. The OCR breach portal currently lists the incident as affecting at least 501 individuals.

In a substitute breach notice on its website, Issaqueena Pediatric Dentistry confirmed that an unauthorized third party gained access to certain files on its system between November 9 and November 11, 2025. Issaqueena Pediatric Dentistry discovered the intrusion on November 11, 2025, when ransomware was used to encrypt files. Its incident response protocols were activated, steps were taken to contain the incident, and law enforcement was notified.

Issaqueena Pediatric Dentistry said files are being reviewed to determine the affected individual and the types of data involved, warning that it is a time-intensive process. Notification letters will be mailed to the affected individuals as soon as possible. The Interlock ransomware group claimed responsibility for the attack, said it exfiltrated 118 GB of data, and listed the data for download on its dark web data leak site, which suggests the ransom was not paid.

Issaqueena Pediatric Dentistry said its network has been secured, and it is working with third-party security experts to implement measures to harden security. Issaqueena Pediatric Dentistry has confirmed that the affected individuals will be offered complimentary credit monitoring and identity theft protection services.

Advanced Homecare Management (Enhabit Home Health & Hospice), Texas

Advanced Homecare Management, LLC, doing business as Enhabit Home Health & Hospice in Dallas, Texas, has notified 22,552 patients that some of their protected health information was compromised in a data breach at one of its business associates.

My 485, Inc., which does business as Doctor Alliance, provides a platform that facilitates the sharing of medical information between doctors and home health agencies and hospices. Enhabit Home Health & Hospice said one or more medical providers may have used the Doctor Alliance platform to facilitate care at entities affiliated with Enhabit, and the platform contained patients’ protected health information.

On December 5, 2025, Doctor Alliance informed Enhabit about a potential security incident involving the data of certain Enhabit patients. Doctor Alliance determined that the platform was subject to unauthorized access between October 31, 2025, and November 6, 2025, and again between November 14, 2025, and November 17, 2025. The platform was accessed by an unauthorized individual using valid credentials for a user account, which allowed access to protected health information such as names, addresses, dates of birth, patients’ gender, physician names, medical record numbers, clinical information, and health plan numbers. Enhabit said financial information and Social Security numbers were not compromised in the incident.

Doctor Alliance has implemented additional authentication mechanisms in the affected software and has notified regulators about the breach. The incident is not yet shown on the OCR breach portal, so the scale of the breach is currently unknown. This appears to have been a ransomware attack. The Kazu ransomware group claimed responsibility.

AltaMed Health Services Corporation, California

AltaMed Health Services Corporation, a provider of primary care, senior care, and health and human services in California, has alerted patients about a cybersecurity incident on December 14, 2025. The incident limited access to some of its computer systems; language often used to describe a ransomware attack.

AltaMed said it immediately initiated its incident response protocols when the cyberattack was detected and worked quickly to contain the incident. Third-party cybersecurity experts were engaged to assist with the investigation, and law enforcement was notified. Under its emergency protocols, AltaMed continued to provide care to patients as scheduled and remained operational throughout the recovery.

The investigation into the incident is ongoing; however, it has been determined that the compromised systems contained some patient information, including names, dates of service, and payment information. Additional safeguards and technical security measures have been implemented to further protect and monitor its systems. The affected individuals have been advised to review their statements and explanation of benefits statements and should report any charges for services that they have not received. Regulators have been notified; however, the incident is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

The post Three Healthcare Providers Affected by Ransomware Attacks appeared first on The HIPAA Journal.