Loading story…
Harris Health, a major healthcare provider in Texas, is notifying 5,000 patients about a significant insider data breach that persisted for over ten years. The breach involved a former employee who accessed electronic health records (EHRs) without a legitimate work-related reason from January 4, 2011, to March 8, 2021. The organization discovered the unauthorized access on February 10, 2021, and immediately launched an internal investigation with the assistance of a forensic firm. Upon confirming the breach, Harris Health reported the incident to the FBI and terminated the employee responsible for the unauthorized access. The investigation revealed that the former employee had disclosed some patient information to unauthorized individuals, raising concerns about the potential misuse of sensitive health data. Due to the ongoing FBI investigation, Harris Health was required by law enforcement to delay notifying affected patients until it would not impede the inquiry. Only after receiving explicit clearance from the FBI was Harris Health able to begin the notification process. The breach affected patients across Harris Health’s extensive network, which includes two trauma center hospitals and 37 clinics, health centers, and specialty locations. The organization emphasized that it is now notifying patients as quickly as possible following the law enforcement directive. The breach notification process is part of Harris Health’s compliance with data security and privacy regulations, and the organization has reiterated its commitment to protecting patient information. The incident highlights the risks posed by insider threats within healthcare organizations, especially given the long duration of undetected access. Harris Health has not been able to determine which specific sensitive information was disclosed in every case, but the potential exposure includes personal and medical data. The organization’s response included collaboration with law enforcement and external forensic experts to assess the scope and impact of the breach. The case underscores the importance of robust monitoring and access controls for EHR systems to prevent and detect unauthorized activity. Harris Health’s experience serves as a cautionary example for other healthcare entities regarding the need for vigilance against insider threats. The breach has prompted a review of internal security policies and procedures to mitigate the risk of similar incidents in the future. The FBI’s involvement and the protracted nature of the investigation demonstrate the complexity of insider breaches in the healthcare sector.
See attribution, scope, and your downstream exposure.
1 event from the most recent confirmed update back to the earliest known activity.
GovInfoSecurity and BankInfoSecurity reported that a hospital insider breach had lasted 10 years and had led to an FBI inquiry. No additional dated milestones or technical details were provided in the reference content.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several U.S. healthcare organizations have disclosed significant data breaches involving unauthorized access to patient and employee information. MedStar Health reported that an unauthorized third party accessed internal systems containing sensitive patient data, including names, dates of birth, Social Security numbers, and medical information. The Rhysida threat group claimed responsibility for this attack, alleging the exfiltration and leak of over 7 million pieces of patient data. Brevard Skin and Cancer Center also confirmed a cyberattack in which the Pear threat group claimed to have stolen 1.8 terabytes of data, affecting both patient and employee records with information such as Social Security numbers, health conditions, and billing details. Both organizations have offered complimentary credit monitoring and identity theft protection to affected individuals and are reviewing their cybersecurity measures. Henry Ford Health in Michigan disclosed an insider data breach affecting nearly 2,000 patients, resulting in the termination of the responsible employee and notification to those impacted. While details on the specific data accessed were not provided, credit monitoring services have been offered. These incidents highlight the ongoing risks faced by healthcare providers from both external threat actors and insider threats, emphasizing the need for robust security policies and continuous evaluation of protective measures to safeguard sensitive health information.
Jun 29, 2026
Multiple healthcare organizations disclosed **data security incidents** involving potential exposure of patient and personal information. Jackson Hospital and Clinic (Montgomery, Alabama) notified **14,485** individuals about a breach at its former debt-collection vendor **Nationwide Recovery Services**, where suspicious activity was identified in July 2024 and an unauthorized party accessed the vendor’s network between **July 5–15, 2024**. Jackson Hospital stated its own IT systems were not affected, but data shared for collections work may have been compromised, including **names, contact details, dates of birth, Social Security numbers, account/insurance information, and dates of service**; affected individuals were offered credit monitoring and identity theft protection. Separately, **Community Health Action of Staten Island** reported a data security incident that may have involved unauthorized access to sensitive personal and medical information, and **Insight Hospital and Medical Center** (Chicago) reported a cyber incident involving unauthorized access to its network between **Aug. 22 and Sept. 11, 2025**, with potential exposure of patient and financial data. The disclosures underscore ongoing third-party and direct-network intrusion risks in the healthcare sector, with notification timing and scope varying by organization and investigation status.
Jun 29, 2026
Several healthcare organizations in the United States have reported significant data breaches resulting in the exposure of protected health information (PHI) for tens of thousands of patients. TriZetto Provider Solutions, a revenue management service provider, discovered unauthorized access to its web portal dating back to November 2024, with attackers accessing historical eligibility transaction reports containing sensitive patient data such as names, addresses, Social Security numbers, and health insurance details. The breach was detected in October 2025, after which immediate remediation steps were taken, including engaging Mandiant for investigation and securing the affected systems. Other incidents include breaches at Morton Drug Company in Wisconsin, Physicians to Children & Adolescents in Kentucky, the Center for Urologic Care of Berks County in Pennsylvania, North Atlantic States Carpenters Health Benefits Fund in Massachusetts, and Millcreek Pediatrics in Delaware. These breaches involved unauthorized network access and resulted in the exposure of PHI, including names, birth dates, medical record numbers, prescription information, and, in some cases, Social Security numbers. Affected organizations have notified impacted individuals and are offering credit monitoring services where appropriate, while also implementing enhanced security measures to prevent future incidents.
Jun 29, 2026