AcademyHealth Hit by SAFEPAY Ransomware Attack, Exposing Sensitive Data AcademyHealth, a non-partisan professional organization focused on health policy and research, suffered a ransomware attack in April 2026, resulting in the exposure of sensitive personal and financial data. The breach was carried out by the cybercriminal group SAFEPAY, which claimed on the dark web on April 6, 2026, that it had stolen the organization’s data and threatened to publish it within a day. The incident was formally disclosed to the Vermont Attorney General on July 27, 2026, though the full scope of affected individuals remains unreported. Compromised data includes credit and debit account details, financial account codes, government ID numbers, and Social Security numbers. Class action law firm Shamis & Gentile P.A. is investigating the breach on behalf of potentially impacted individuals, who may be eligible for compensation. AcademyHealth, formed in 2000 through the merger of the Alpha Center and the Association for Health Services Research, serves as a key resource for health policy professionals through conferences, training, and research translation. The attack highlights ongoing risks to organizations handling sensitive data.