Loading story…
An audit by the Utah State Auditor found critical privacy and security weaknesses at the Utah Department of Health and Human Services (DHHS), following a whistleblower complaint alleging inadequate incident response procedures and insufficient monitoring to detect and manage privacy incidents. The review focused on two high-sensitivity systems—SAFE (Utah’s child welfare case management system, reported to contain ~6 million records tied to >2 million individuals) and eChart (a mental health records repository maintained by the Utah State Hospital)—and concluded that gaps in documentation, controls, and oversight increase the risk of unmitigated exposure of sensitive data, particularly children’s information.
Separately, British Columbia’s Office of the Information and Privacy Commissioner reported intentional “snooping” by healthcare staff into patient records following the Lapu Lapu Day festival tragedy, with 71 unauthorized access incidents affecting the medical records of 16 individuals and attributed to 35 employees across multiple health authorities (plus one physician-office assistant). In contrast, HIPAA Journal’s reminder about the March 1, 2026 deadline for reporting “small” (<500 individuals) healthcare breaches to HHS OCR is primarily compliance guidance rather than a specific incident, though it underscores regulatory expectations for timely breach notification and the risk of penalties and compliance investigations for late reporting.
See the actors and campaigns active against you right now.
7 events from the most recent confirmed update back to the earliest known activity.
Following the audit findings, Utah DHHS was reported to be implementing recommended improvements to address the identified privacy and security deficiencies. The changes were aimed at strengthening access controls, monitoring, and reporting mechanisms.
The Utah State Auditor found critical privacy and security weaknesses in DHHS systems, including overly broad access, poor monitoring, improper disclosures, and excessive data retention. Auditors said the issues could expose residents' health information but found no evidence that SAFE or eChart had been successfully hacked.
A whistleblower complaint alleging inadequate incident response and insufficient monitoring prompted the Office of the Utah State Auditor to examine the Utah Department of Health and Human Services. The review focused on the SAFE child welfare system and the eChart mental health records repository.
The Office of the Information and Privacy Commissioner for British Columbia disclosed that about half of the patients treated after the Lapu Lapu Day festival tragedy later had their privacy breached. The report said 71 snooping incidents affected 16 individuals and stressed that such access is illegal, unethical, and damaging to trust in healthcare providers.
By June 20, 2025, the reporting period for the notified snooping incidents had reached 71 incidents involving the records of 16 individuals. The breaches were attributed to 35 employees across health authorities and Providence Health Care, plus one assistant at a physician's office with access to Fraser Health systems.
Between April 30, 2025 and June 20, 2025, multiple British Columbia health organizations notified the Office of the Information and Privacy Commissioner of intentional, unauthorized employee access to patient records tied to the festival incident. The reports concerned patients who received care after the tragedy.
Following the April 26, 2025 tragedy at the Lapu Lapu Day festival in British Columbia, multiple individuals received medical treatment. These patients later became the subjects of privacy breaches involving their medical records.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Utah state privacy audit concluded that systemic weaknesses in **access controls**, records request handling, and **incident response preparedness** are putting sensitive child welfare and health information at risk within two Utah Department of Health and Human Services (DHHS) data repositories. The audit—stemming from a May 2025 probe and published by state auditor **Tina Cannon**—characterized the deficiencies as a critical failure to protect vulnerable populations, warning that inadequate safeguards around highly confidential data could enable misuse and long-term harm. The review was initiated following a **whistleblower complaint** from a DHHS employee, according to the state auditor’s office. One of the repositories examined was the **SAFE** system used by the Division of Child and Family Services, with auditors citing inadequate access controls and insufficient incident response planning as key gaps requiring remediation to reduce exposure of sensitive records affecting millions of children and adults in Utah.
Jun 29, 2026
**US healthcare organizations reported unusually low numbers of large HIPAA breaches in late 2025**, with 41 incidents affecting 500+ individuals logged for December 2025 in the HHS OCR breach portal. Reporting volumes for September–December averaged ~40.75 large breaches per month versus ~66.5 in the prior four months, and 2025 totals stood at 697 breaches (a reported ~6% decrease from 2024), though the count was expected to rise as additional incidents are added. A key factor cited for the apparent decline was a **43-day US government shutdown** that furloughed most HHS staff and likely created a backlog in posting breach reports to the OCR portal, potentially suppressing late-2025 totals until processing is completed. Separately, a **VA Office of Inspector General** review found a **privacy and security compliance failure** within the Veterans Health Administration’s national cancer testing program tied to a collaborative research effort. The OIG reported that in 2022 a VHA research director created and shared a file containing electronic health record reports and a “significant amount” of **protected health information (PHI)** with non-VHA investigators **without institutional review board approval or de-identification**, and that required **audit logs** for secure ePHI management were missing. The OIG noted delays in reporting and inadequate early mitigation, and issued six recommendations that the VA agreed to implement, including removing PHI from shared materials, clarifying research processes, and improving training.
Jun 29, 2026
Multiple organizations reported or were alleged to have suffered **data breaches involving sensitive personal and health information**. Telehealth provider **Call-On-Doc** was allegedly breached in early December, with a hacking-forum listing claiming exfiltration of **1,144,223 patient records** including contact details and highly sensitive visit metadata (e.g., *medical category/condition*, including STD-related entries), though the company had not publicly commented at the time of reporting. Separately, **Laurel Health Centers** (a Federally Qualified Health Center network in Northern Pennsylvania) reported **unauthorized access to its email environment** from July 11–25, 2025; emails and attachments may have been viewed or copied, potentially exposing a wide range of PHI/PII (including SSNs, insurance/Medicare data, diagnostic/treatment information, and some financial data). Laurel stated it took time to confirm the threat actor was fully removed, completed mailbox review by Dec. 30, 2025, and then began notifying affected individuals and offering credit monitoring. Outside healthcare delivery, the **Civil Service Employees Association (CSEA)** labor union reported a May intrusion (May 3–31) resulting in theft of data for **47,000+ members**, including names and **Social Security numbers**, and said it took systems offline, reset passwords, and implemented additional security controls; it reported no evidence of misuse but advised vigilance for identity theft. A separate HIPAA Journal item summarized academic research on **insider risk**—finding many students would hypothetically sell patient data for money—which is not tied to a specific breach incident but underscores the broader threat environment for healthcare data.
Jun 29, 2026