Major Healthcare Data Breaches Expose Millions of Patient Records in Early 2026 The U.S. Department of Health and Human Services (HHS) recently updated its healthcare data breach tracker, revealing several significant incidents affecting millions of individuals. The breaches, disclosed in early 2026, highlight persistent vulnerabilities in the sector, particularly through third-party vendors and prolonged unauthorized access. The largest breach involves New York City Health and Hospitals Corporation, which reported a compromise affecting 1.8 million individuals. Detected on February 2, 2026, the investigation found that threat actors accessed systems between November 2025 and February 2026 via a third-party vendor. Exposed data includes personal, health insurance, medical, biometric, and financial information. In Chicago, Illinois, Erie Family Health Centers discovered a hack in January 2026, with attackers active on its network from December 10, 2025, to late January 2026. The breach compromised names, Social Security numbers (SSNs), driver’s license details, passport numbers, financial data, and medical records, impacting 570,000 individuals. Florida Physician Specialists reported a breach affecting 276,000 patients, with hackers accessing its network for two days in November 2025. Exposed data includes names, SSNs, driver’s license numbers, financial details, and medical information. Other notable breaches include: - Coastal Carolina Health Care (North Carolina) – 110,000 individuals affected, detected over a year after the intrusion. - Western Orthopaedics (Colorado) – 110,000 individuals impacted. - Nacogdoches Memorial Hospital (Texas) – Initially reported as affecting 250,000, but the HHS tracker lists 2.5 million, suggesting a possible error. - An Arizona dermatology clinic – Initially reported as 3 million affected, later corrected to 500. None of the breaches have been claimed by known cybercrime groups. The incidents underscore ongoing risks in healthcare cybersecurity, particularly from third-party vulnerabilities and delayed breach detection.

The California Office of the Attorney General reported a data breach involving Blackbaud, Inc., for Northwest Foundation, Inc. on August 7, 2020. The breach resulted from a ransomware attack that occurred in May 2020, potentially exposing public information like names, addresses, and philanthropic data, though no social security numbers or financial account details were involved.