Loading story…
Multiple organizations reported or resolved matters related to cyber incidents affecting sensitive personal data. Choice Hotels International disclosed that a “skilled person” used social engineering to access (despite MFA) an application containing records for franchisees and franchise applicants, exposing data including names and Social Security numbers; the company indicated the incident involved franchise-related records rather than guest data. Separately, Wynn Resorts had not publicly responded to claims by ShinyHunters that the actor obtained roughly 800,000 records, with no proof posted and no apparent public filing or statement at the time referenced; reporting suggested the alleged exposure may involve employee data rather than guest data. In Taiwan, The Grand Hotel (Taipei) reported detecting unauthorized access and stated it could not yet rule out impact to customer/guest data.
In healthcare, a small medical practice in Northern Ireland (Grange Dental Care) reported a compromise that led to fraudulent emails being sent from the practice’s systems requesting invoice payments; the practice stated it identified the issue quickly and engaged its IT provider to contain and investigate, with initial indications the attack originated overseas. Separately, Granite Wellness Centers (California) and Pediatric Home Service (Minnesota) agreed to class action settlements tied to earlier cyberattacks exposing patient data; Granite’s matter stems from a January 2021 ransomware attack in which files containing extensive patient and identity data were confirmed accessed, and the organization agreed to a $725,000 settlement fund while denying wrongdoing and liability.
See attribution, scope, and your downstream exposure.
8 events from the most recent confirmed update back to the earliest known activity.
A report stated that Wynn Resorts had not publicly responded to claims that ShinyHunters obtained 800,000 records, and that no proof or SEC material-incident filing had been identified. The claim remained unverified at the time of reporting.
The Grand Hotel in Taipei reported detecting unauthorized access to its systems and said it could not yet rule out an impact on customer data. No threat actor was publicly identified in the report.
Pediatric Home Service agreed to settle litigation arising from its November 2024 breach, offering reimbursement for documented losses, a $50 cash option, and credit monitoring services. The company denied wrongdoing and said it settled to avoid continued litigation costs and risk.
Granite Wellness Centers agreed to settle litigation tied to its 2021 ransomware incident through a $725,000 settlement fund with multiple compensation options for class members. The company denied wrongdoing and said it settled to avoid the cost and risk of continued litigation.
On a Thursday morning, Grange Dental Care's computer system was hacked, and recipients began receiving fraudulent invoice-payment emails around 9:50 a.m. The practice contacted its IT provider, stopped activity to limit damage, and began an investigation that initially suggested the attack originated overseas.
On January 14, 2026, Choice Hotels International disclosed that a social-engineering attack led to unauthorized access to an application containing franchisee and franchise applicant records, including names and Social Security numbers. The company said multifactor authentication had been required despite the compromise.
Pediatric Home Service experienced a network intrusion in November 2024 that affected tens of thousands of individuals. The breach later led to class action litigation and a proposed settlement offering reimbursement, cash payments, and credit monitoring.
Granite Wellness Centers experienced a ransomware incident in January 2021 that exposed sensitive information of up to 15,600 individuals. The incident later became the basis for a class action lawsuit and settlement.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourcedatabreaches.net
Open sourcehipaajournal.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple U.S. healthcare organizations reported **unauthorized network access and patient data exposure**, with several incidents involving confirmed **data exfiltration** and follow-on notification/credit-monitoring actions. **QualDerm Partners** disclosed unauthorized access between **Dec. 23–24, 2025** with files exfiltrated and notifications being sent on a rolling basis, while **Carolina Foot & Ankle Associates** reported a **Dec. 2025** intrusion detected after a network disruption and confirmed exfiltration of files containing PHI (e.g., demographics, MRNs, insurance data, and treatment/billing codes). Additional breach disclosures included **Cedar Point Health** (intrusion detected around **June 16, 2025**, with a months-long data review concluding in late Jan. 2026 and impacted data potentially including SSNs/ITINs and government IDs) alongside separate notifications from **Wee Care Pediatrics** and **Easterseals Northeast Indiana**. Legal and regulatory consequences continued to surface from earlier healthcare incidents. **Asheville Eye Associates** agreed to settle consolidated class-action litigation tied to a **Nov. 2024** attack claimed by **DragonForce ransomware**, which allegedly exfiltrated **~540 GB** before encrypting systems and later leaked data when ransom was not paid; the breach was reported to HHS OCR as affecting **204,984** individuals. Sector-wide reporting also indicated **46** large healthcare breaches logged for **Jan. 2026** on the HHS OCR portal (500+ individuals), exposing **~1.44 million** individuals’ PHI, amid discussion that late-2025 reporting backlogs may have influenced recent month-to-month trends.
Jun 29, 2026
Over 4 million Texans have been affected by a significant data breach at Conduent Business Services, marking one of the largest such incidents in U.S. history. The breach has prompted legal action and investigations, with the potential for compensation for impacted individuals. In a separate incident, Doctor Alliance, a healthcare technology firm serving multiple providers, suffered a cyberattack resulting in the theft of over 1.2 million records. Attackers have threatened to release sensitive medical data, including diagnoses, prescriptions, and insurance information, unless a ransom is paid, raising serious concerns about identity theft and medical fraud. Additionally, The Thayer Hotel in New York experienced a breach in which more than 33,000 individuals had personal information stolen, including government-issued IDs and, in some cases, Social Security numbers. The hotel, located near the West Point Military Academy, has offered affected individuals free identity theft protection. While there is no evidence yet of misuse, the stolen data could be leveraged for phishing, identity theft, or malware attacks, especially given the military-affiliated clientele. These incidents highlight the ongoing risks posed by cyberattacks targeting organizations that handle sensitive personal and medical information.
Jul 12, 2026
Several healthcare-related organizations disclosed **separate data breach incidents** involving ransomware, unauthorized network access, and third-party compromise. CommonSpirit Health said patient data was exposed through a downstream vendor chain after **Pinnacle Holdings Ltd** suffered a ransomware attack, with attackers present in the network from November 11 to November 25, 2024, and exfiltrating files before the incident was later relayed through **NorthGauge Healthcare Advisors**. Meadowlark Hills and MedPeds also disclosed breaches tied to the **Beast ransomware** group, while Tieu Dental reported unauthorized access to its network in July 2025 that exposed patient information including Social Security numbers, medical and insurance data. These incidents led to regulatory notifications and offers of credit monitoring or identity theft protection for affected individuals. A separate legal development involved **Geisinger Health** and **Nuance Communications**, where a judge approved a **$5 million settlement** over claims tied to a former Nuance employee's theft of medical records affecting about 1.3 million patients. That matter differs from the ransomware and breach notifications because it concerns civil litigation over an earlier insider data theft rather than a newly disclosed intrusion. Overall, the reporting reflects ongoing exposure of protected health information across the healthcare sector through both direct attacks and third-party relationships, with delayed notification timelines and incomplete early visibility into the full scope of compromised data remaining recurring issues.
Jun 29, 2026