Multiple Healthcare Data Breaches Expose Sensitive Patient Information Across U.S. A series of cyberattacks targeting healthcare providers in 2025 and 2026 has compromised the personal and medical data of tens of thousands of patients nationwide. Blue Fish Pediatrics (Texas) In July 2025, Houston-based Blue Fish Pediatrics detected unauthorized access to its IT systems between July 11 and July 17. A forensic investigation revealed that threat actors accessed files containing sensitive patient data, including full names, dates of birth, Social Security numbers, driver’s license numbers, medical records, diagnoses, lab results, and treatment details. While the total number of affected individuals remains undisclosed, the Texas Attorney General reported that 41,485 Texas residents were impacted. Affected patients are being notified and offered complimentary credit monitoring if their Social Security numbers were exposed. Cherry Health (Michigan) Michigan’s largest non-profit Federally Qualified Health Center, Cherry Health, announced a breach on June 18, 2026, after detecting suspicious network activity on April 19, 2026. Unauthorized access led to the theft of patient data, including names, addresses, insurance details, and, in some cases, Social Security numbers. The organization has not reported any misuse of the stolen data but is implementing additional security measures. The full scope of the breach is still under review. Coastal Carolina Centers of Urology and Surgery (South Carolina) The Rivertown Surgery Center in Conway, South Carolina, reported a ransomware attack by the Qilin ransomware group, which accessed patient records on August 26, 2025. The breach exposed names and health records of 2,886 individuals, with the group posting stolen data on its dark web leak site on September 4, 2025. Notifications were sent to affected patients in May 2026. Regence (Oregon) Regence Blue Cross Blue Shield of Oregon disclosed a breach affecting 2,856 members after unauthorized actors accessed digital accounts between January 1 and April 15, 2026. The attackers redeemed wellness rewards for gift cards, potentially exposing account information. The incident was reported to federal authorities, though no further details on data exposure have been released. These breaches highlight ongoing vulnerabilities in healthcare cybersecurity, with attackers targeting sensitive patient data across multiple states.

Coastal Medical Group, Old Bridge suffered from a data breach incident that involved the patients’ health information. The results of the investigation showed that the incident led to the unauthoritarian access and acquisition of some files from the practice's computer systems. The exposed information includes full name, home address, date of birth, and other demographic and contact information, Social Security number, insurance information, and diagnosis and treatment information. The affected computer systems did not contain any payment card or financial account information. All of Coastal Medical Group's patients gets notifications about the incident and options to assist safeguard the security of their personal data.