AI Healthcare Platform Lena Health Hit by Major Data Breach Exposing Sensitive Patient Data On June 1, 2025, cybersecurity researchers uncovered a significant data breach at Lena Health, an AI-powered care coordination platform based in Houston, Texas. The breach, attributed to the hacking group FulcrumSec, exposed the protected health information (PHI) of over 2,100 patients, primarily from Houston Methodist, along with thousands of recorded phone calls and sensitive medical documents. ### How the Breach Occurred FulcrumSec exploited an unpatched vulnerability in Lena Health’s systems, which had been publicly disclosed in early December 2024. Despite a patch being available, Lena Health had not applied it by the time the attack occurred in mid-to-late December. The hackers gained access to an unencrypted, public-facing S3 bucket, which contained: - 2,134 patients’ full PHI (names, dates of birth, phone numbers, medical record numbers) - 19,542 recorded phone calls (later clarified to be fewer than 7,500 after deduplication), many with full transcriptions - 68 hospital discharge documents with highly sensitive details, including prescriptions for controlled substances, post-surgical care instructions, and intimate medical conditions - API keys, staff login credentials, and patient phone numbers linked to elderly and vulnerable individuals ### Hackers’ Motives and Response from Lena Health FulcrumSec claimed their attack was part of a broader campaign targeting "AI-driven SaaS startups" they accused of poor security practices. They contacted Lena Health on January 10, 2025, but the company initially failed to respond. After being provided with proof of the breach, Lena Health acknowledged the issue but ceased communication before taking further action. The hackers later released redacted samples of the stolen data on a dedicated webpage, though they have not yet dumped the full dataset. Notably, some patients may have been unaware they were interacting with an AI system, as call recordings included personal details about living situations and medical needs. ### Regulatory and Legal Implications As a HIPAA business associate for Houston Methodist, Lena Health’s breach raises serious compliance concerns. The exposed data includes HIPAA-protected information, such as medical conditions, prescriptions, and doctor-patient communications. Neither Lena Health nor Houston Methodist has publicly responded to requests for comment as of this report. The incident follows another major healthcare breach disclosed the same week, where Serviceaide, an AI healthcare software provider, exposed the data of 483,000 patients at Catholic Health in Buffalo, New York, due to an unsecured database. That breach, discovered in May 2025, has already resulted in six federal class-action lawsuits.

Houston Methodist Cancer Center suffered a data breach that compromised the 1,417 cancer patients’ email addresses. Patients at Houston Methodist Cancer Center were informed that all receivers' addresses were displayed, possibly disclosing their identities and affiliation with the medical center to the general public. Methodist's investigated the incident and tried to recall the emails and develop additional technical safeguards to prevent this situation from happening again and retrained appropriate staff."