Mass General Brigham (Boston)
520K patient records exposed via compromised third-party scheduling vendor
Healthcare Data Breaches (727 indexed)
Change Healthcare (Ongoing Fallout)
Continued discovery of exposed records — total revised upward to 190M affected individuals
Change Healthcare (2025 Update)
Updated count: 190M Americans affected — largest healthcare breach in US history confirmed
Ascension Health (Former Partner)
437K patient records stolen from former business partner system
BrightSpring Health Services
3.4M home health and pharmacy patient records exposed in ransomware incident
Conduent Business Services
10.5M individuals affected — SafePay ransomware targeting government health contracts
Concentra Health (2025)
890K patient records exposed in vendor platform breach
CommonSpirit Health (Follow-Up)
870K additional patient records identified from 2024 ransomware attack residual access
Sentara Healthcare (Virginia)
780K patient records exposed
McGill University Health Centre
670K patient records stolen in targeted attack
Frederick Health Medical Group
934K patient records compromised in ransomware attack on Maryland healthcare group
GSK (GlaxoSmithKline)
560K pharmaceutical records exposed in targeted attack
Anna Jaques Hospital
316K patient records stolen in Christmas Day ransomware attack on Massachusetts hospital
Community Health Center Inc
1M patient records exposed in data breach
Community Health Center (Connecticut)
1M+ patient records including SSNs and health diagnoses accessed by threat actor
SickKids Toronto
Patient and research data temporarily encrypted in LockBit attack — decryptor provided after backlash
PowerSchool (student health records)
62M student and staff records including health data exposed
ESO Solutions
2.7M patient records from hospital and fire department EMS systems exposed in ransomware attack
Saint Francis Health System (Oklahoma)
275K patient records exposed — attackers exfiltrated surgical and billing records
University of Pittsburgh Medical
560K patient records stolen
Vancouver Coastal Health Authority
445K patient records exposed after contractor laptop theft — unencrypted drive
Roche
450K patient data records exposed via vendor
Alder Hey Children's Hospital
INC Ransom gang stole patient records from Liverpool children's hospital
Wirral University Teaching Hospital
Cyberattack forced hospital to declare major incident — systems offline for days