Cyberattacks and data breaches have been announced by Crenshaw Community Hospital in Alabama, Waveny LifeCare in Connecticut, Aunt Martha’s Health and Wellness in Illinois, Pulse Urgent Care Center in California, and MyCardiologist in Florida.

Crenshaw Community Hospital

Crenshaw Community Hospital in Luverne, Alabama, has recently announced a security incident. Crenshaw Community Hospital said the incident was detected on June 16, 2025, and involved “network disruption that impacted the functionality and access of certain computer systems.” Third-party cybersecurity experts were engaged to investigate the incident and provide help with securing its environment. The investigation into the attack is ongoing, but it has been determined that certain files were copied from its systems.

The ransomware group, Payouts King, has claimed responsibility for the attack. The group is known to engage in double extortion, stealing data and demanding payment to prevent its publication and for the decryption keys to unlock files. The group claims to have exfiltrated 53 GB of data, and has listed Crenshaw Community Hospital on its dark web data leak site, and claims to have published the entire dataset as the ransom was not paid.

Crenshaw Community Hospital is still reviewing the affected data to determine the individuals affected and the types of data involved. Individual notification letters will be mailed when the file review is concluded. In the meantime, all patients have been advised to remain vigilant against identity theft and fraud by monitoring their account statements, explanation of benefits statements, and free credit reports.

Waveny LifeCare

Waveny LifeCare Network, a New Canaan, Connecticut-based provider of senior living and healthcare services, has experienced a cyberattack that disrupted its network systems. The attack was detected on or around May 28, 2025, and immediate action was taken to contain the incident and secure its systems. Waveny LifeCare engaged third-party cybersecurity experts to assist with the investigation, who confirmed that the attackers accessed certain data on its network.

The investigation and file review are ongoing, but it has been confirmed that the following types of information were involved: name, address, date of birth, admission/discharge date, date of death, telephone number, email address, Social Security number, medical record number, patient account number, facial photographic images, laboratory test results, medical imaging results, driver’s license number, electronic health records, health insurance account or policy number, payment information, Medicare or Medicaid information, and/or financial account number. While sensitive data was accessed, no evidence has been found to date to indicate that any of that information has been misused. Notification letters will be sent to the affected individuals when the file review is concluded.

Aunt Martha’s Health and Wellness

Aunt Martha’s Health and Wellness, a provider of community health, wellness, and support services in Illinois, has fallen victim to a ransomware attack. The attack was detected on August 13, 2025, when suspicious network activity was observed. The forensic investigation confirmed that a threat actor gained access to its computer network on August 12, 2025, exfiltrated sensitive data, and deployed malware that encrypted files. The attack was rapidly contained, and systems and data were restored from backups, without paying the ransom. No evidence has been found to indicate that any of the compromised data has been misused; however, the affected individuals have been advised to remain vigilant against identity theft and fraud.

While the file review is ongoing, Aunt Martha’s Health and Wellness has identified the general categories of information exposed in the incident as name, address, birth date, provider/facility name, medical condition, diagnosis information, treatment information, lab results, prescriptions/medications, personal history, mental health information, insurance/payment amount history information, date(s) of service, Social Security number, medical information, health insurance information, and driver’s license or state identification number. Other information created, used, or disclosed in the course of providing health care services may also have been compromised.

Pulse Urgent Care Center

Pulse Urgent Care Center, which has locations in Redding and Red Bluff in California, is alerting patients about a network security breach that was identified on March 24, 2025.  The incident was investigated and determined to involve network access by an unauthorized third party who deployed malicious software. The attack caused temporary disruption to its IT systems; however, network access and data were rapidly restored from backups, and normal operations were quickly resumed.

The investigation confirmed on May 1, 2025, that some patient data had been exposed and many have been viewed or acquired. The types of data involved vary from individual to individual, and may include names, dates of birth, home addresses, phone numbers, diagnoses, service dates, and treatment information. Pulse Urgent Care Center has strengthened its web server infrastructure and has implemented enhanced safeguards to prevent similar incidents in the future. Individual notification letters state the specific information involved for each individual. The incident is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

MyCardiologist

Cardiovascular Medicine Associates, PA, which does business as MyCardiologist, a cardiology practice with nine locations in South Florida, is alerting patients about a cyberattack involving the theft of data from its network. The attack was detected on June 12, 2025, when suspicious activity was observed within its email system. Third-party investigators determined that its email system was compromised on May 30, 2025, and an unauthorized third party had access to its environment until June 12, 2025, when the security breach was identified and blocked. The forensic investigation confirmed that the threat actor copied data from its environment.

Notification letters started to be mailed to the affected individuals on October 7, 2025, following a comprehensive and time-consuming review of the affected data. The review confirmed that names, addresses, dates of birth, clinical information, diagnoses, provider names/locations, and Medicare numbers were compromised in the incident. No evidence has been found to indicate that any of the impacted data has been misused; however, as a precaution, the affected individuals have been offered complimentary credit monitoring and identity theft protection services for 24 months. The incident is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

The post Five Healthcare Providers Warn Patients About Cyberattacks & Data Breaches appeared first on The HIPAA Journal.

Data breaches have recently been announced by Methodist Homes of Alabama & Northwest Florida, Rockhill Women’s Care, and Sierra Vista Hospital & Clinics.

Methodist Homes of Alabama & Northwest Florida

Methodist Homes of Alabama & Northwest Florida, a provider of affordable homes, senior living, and healthcare services, disclosed a data breach on October 8, 2025, involving unauthorized access to the personal and protected health information of almost 26,000 residents, employees, and other individuals. The breach occurred almost one year previously, having first been detected on October 14, 2024.

An investigation was launched to determine the cause of suspicious network activity, which confirmed that an unauthorized actor had access to its network between October 2, 2024, and October 14, 2024. During that time, sensitive data may have been accessed or acquired. All exposed files were reviewed, and that process was completed on September 2, 2025. Notification letters have now been mailed to all individuals with valid contact information, and regulators have been notified, including the HHS’ Office for Civil Rights.

The incident is not yet shown on the HHS’ Office for Civil Rights breach portal; however, the Maine Attorney General was informed that 25,579 individuals have been affected in total. The information involved varies from individual to individual and may include names in combination with one or more of the following: Social Security number, driver license or state ID number, health insurance number, and clinical information, including medical record number, medical history, diagnosis and treatment information, patient number, Medicaid/Medicaid number, date of discharge, and date of birth.

Individuals who were neither patient nor resident had their first and last name exposed, plus one or more of the following: Social Security number, driver’s license number, state ID, health insurance number, and medical history information. Credit monitoring services have been offered free of charge to individuals whose Social Security numbers were involved.

Rockhill Women’s Care

The OB-GYN medical practice, Rockhill Women’s Care, which has locations in Overland Park, Kansas, and Lee’s Summit, Missouri, has started notifying patients about a security incident that affected its IT systems and exposed patient information. Suspicious network activity was identified on or around February 26, 2025, and third-party cybersecurity experts were engaged to investigate the activity and assist with remediation. The substitute breach notice does not state when its network was first accessed or for how long hackers had access to the network.

The file review concluded on August 13, 2025, when it was confirmed that the information compromised in the incident included names, addresses, dates of birth, Social Security numbers, treatment information, and, for some patients, also health insurance information. The data breach is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is unclear how many individuals have been affected.

Sierra Vista Hospital & Clinics

Sierra Vista Hospital & Clinics in Truth or Consequences, New Mexico, has identified unauthorized access to its computer network and the exposure of patient information. The unauthorized access was identified on January 29, 2025, and working with third-party digital forensics specialists, it was determined that a threat actor had access to its network from January 14, 2025, to January 31, 2025.

A comprehensive review was conducted to determine whether patient data had been exposed, and on August 13, 2025, it was confirmed that sensitive patient data may have been accessed or acquired, including first and last names, addresses, state identification numbers/driver’s license numbers, medical information, and health insurance information. Network security has been strengthened, and additional cybersecurity measures have been implemented to prevent similar breaches in the future. Those measures include strengthened email filtering and malware monitoring, and additional cybersecurity awareness training is being provided to the workforce.

The incident is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is unclear how many individuals have been affected. The Texas Attorney General was notified that 481 Texas residents were affected.

The post Almost 26,000 Individuals Affected by Data Breach at Methodist Homes of Alabama & Northwest Florida appeared first on The HIPAA Journal.

A data breach at the Fort Wayne Medical Education Program has affected almost 30,000 individuals. Data breaches have also been announced by Space Coast Vascular in Florida and Partners in Pediatrics in Colorado.

Fort Wayne Medical Education Program

Fort Wayne Medical Education Program, a family medicine residency in Northeastern Indiana, has recently announced a security incident that potentially involved unauthorized access to the personal and protected health information of up to 29,485 individuals, including patients, employees, and employees’ dependents.

Suspicious activity was identified within its computer network on December 17, 2024, and after securing its systems, the activity was investigated. The forensic investigation confirmed that an unauthorized actor had access to its computer network from December 12, 2024, to December 17, 2024, during which time files containing sensitive data may have been viewed or acquired. The file review was completed on September 9, 2025, when it was confirmed that personal and protected health information had been exposed.

The types of data involved vary from individual to individual. For employees and their dependents, the exposed data included first and last names, in combination with a Social Security number, driver’s license number, state ID number, or passport number. For patients, the exposed information includes names in combination with some or all of the following: Social Security number, government ID number such as driver’s license or passport number, date of birth, medical information, health insurance information, and medical billing information, which may have included bank account number and payment or credit card number (but not CVC). Notification letters were mailed to the affected individuals on October 2, 2025, and complimentary credit monitoring and identity protection services have been offered to individuals whose Social Security number was involved.

Space Coast Vascular

Space Coast Vascular, a vascular and venous health diagnostic laboratory and treatment center in Melbourne, Florida, has announced that it was the subject of a criminal cyberattack on or around January 13, 2025, that impacted its computer systems. Assisted by third-party cybersecurity experts, Space Coast Vascular learned on August 7, 2025, that patients’ protected health information had been exposed and may have been viewed or acquired by the threat actor.

The types of data involved vary from individual to individual and may include name, date of birth, Social Security number, driver’s license/state ID number, medical treatment information, health insurance information, and/or financial account information. At the time of issuing notifications, Space Coast Vascular was unaware of any misuse of patient data as a result of the incident.

The affected individuals are now being notified by mail, and at least 12 months of complimentary credit monitoring and related services are being offered.  Space Coast Vascular has also confirmed that a series of cybersecurity improvements have been made to reduce the risk of similar incidents in the future. The incident is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

Partners in Pediatrics

Partners in Pediatrics, an integrative pediatric healthcare practice with offices in Denver and Englewood in Colorado, has recently notified patients about a recent email account breach. Suspicious activity was identified in an employee’s email account on March 5, 2025. The email account was secured, and digital forensics experts were engaged to investigate the activity. They determined that the threat actor had access to emails containing patient information; however, no other systems were affected. The emails were reviewed, and that process was completed on September 23, 2025. Information potentially compromised in the incident includes names, dates of birth, Social Security numbers, driver’s license numbers, clinical information, treatment information, lab test results, prescription information, provider information, and health insurance information.

Data privacy and security policies and procedures have been reviewed, and security measures have been enhanced to prevent similar incidents in the future. On October 3, 2025, individual notification letters started to be mailed to the affected individuals. The incident is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

The post Fort Wayne Medical Education Program Data Breach Affects Almost 30,000 Individuals appeared first on The HIPAA Journal.