Alberta Health Services Hit by Major Data Breach – May 2026 On May 6, 2026, Alberta Health Services (AHS) disclosed a significant data breach affecting an undisclosed number of individuals. The incident exposed sensitive personal and health-related information, though specific details on the compromised data remain limited. The breach was detected following unusual activity within AHS systems, prompting an immediate investigation. While the full scope and method of the attack have not been publicly confirmed, early reports suggest potential unauthorized access to patient records, including medical histories and personally identifiable information (PII). AHS has not identified the responsible party, but cybersecurity experts suspect the involvement of ransomware or state-sponsored actors, given the healthcare sector’s increasing targeting by cybercriminals. The organization is working with law enforcement and third-party forensic teams to assess the damage and secure affected systems. The breach underscores the growing vulnerability of healthcare institutions to cyber threats, with potential implications for patient privacy, regulatory compliance, and public trust. Further updates are expected as the investigation progresses.

Alberta Health suffered a data breach after at least 12 users downloaded the wrong information from the province's COVID-19 vaccination record website. The record those users downloaded contained the name, date of birth and vaccine information.  Albertans experienced issues accessing the updated vaccine record for travel due to the breach.

Alberta Health Services (AHS) says a computer hard drive that contained the personal health information of about 650 patients has been missing since August. The exposed information includes patient names, gender, dates of birth, physician names and medical record numbers. The agency says the external drive vanished from a cardiac outpatient clinical lab at the Mazankowski Alberta Heart Institute in Edmonton. It was found that the external drive was not encrypted, as mandatory, and did not have password protection.

Almost 7,000 patients were informed by Alberta Health Services that a doctor's Gmail account had been stolen, exposing their personal health information. The doctor working at the Richmond Road Diagnostic Centre in Calgary improperly used a private account to transmit health information While this privacy breach was unintentional and was deeply regretted by the physician, that does not in any way diminish the seriousness of the matter. There was no evidence to suggest that affected patients' information has been accessed by the hacker, the agency says.