Loading story…
Greater Pittsburgh Orthopaedic Associates (GPOA) reported an August 2025 security incident involving unauthorized access to its IT network, which it detected around August 10, 2025. GPOA told state regulators and affected individuals that a forensic investigation determined patient data could have been compromised, with potentially exposed elements including name, mailing address, Social Security number, and provider name; the organization said it engaged incident response support, notified law enforcement, and began security hardening and awareness efforts.
Regulatory reporting and victim notification timelines and counts appear inconsistent across disclosures: GPOA reported the incident to HHS in late August 2025 as affecting roughly 35,000 individuals, while later filings to the Maine Attorney General indicated 56,954 impacted people, and individual notification letters were mailed in early February 2026. Separately, the RansomHouse leak site listed GPOA in August 2025 and claimed the victim was encrypted, posting a limited “proof pack,” but the listing was not updated and there was no clear confirmation from GPOA that ransomware encryption or data publication occurred.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
In a February 20, 2026 disclosure to the Maine Attorney General, GPOA's external counsel reported that 56,954 people were affected. This updated count was significantly higher than the earlier HHS filing.
On February 5, 2026, GPOA began sending notification letters to affected people about the August 2025 breach. The letters said exposed data may have included names, mailing addresses, Social Security numbers, and provider names, and offered credit monitoring through Cyberscout.
GPOA reported the incident to the U.S. Department of Health and Human Services on August 27, 2025. That filing said the breach affected 35,000 patients.
On August 20, 2025, the RansomHouse ransomware group listed GPOA on its dark web leak site and claimed the organization had been encrypted. The listing included a "proof pack," but was not later updated.
Greater Pittsburgh Orthopaedic Associates said it detected unauthorized access to its IT network on or around August 10, 2025. The organization initiated incident response, engaged third-party experts, and began a forensic investigation.
In May 2024, a group calling itself DonutLeaks allegedly claimed to have hacked "Pittsburgh’s Trusted Orthopaedic Surgeons," which may have referred to GPOA. The incident was not reflected in HHS's public breach tool and remains unconfirmed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourceteiss.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple U.S. healthcare organizations reported **unauthorized network access and patient data exposure**, with several incidents involving confirmed **data exfiltration** and follow-on notification/credit-monitoring actions. **QualDerm Partners** disclosed unauthorized access between **Dec. 23–24, 2025** with files exfiltrated and notifications being sent on a rolling basis, while **Carolina Foot & Ankle Associates** reported a **Dec. 2025** intrusion detected after a network disruption and confirmed exfiltration of files containing PHI (e.g., demographics, MRNs, insurance data, and treatment/billing codes). Additional breach disclosures included **Cedar Point Health** (intrusion detected around **June 16, 2025**, with a months-long data review concluding in late Jan. 2026 and impacted data potentially including SSNs/ITINs and government IDs) alongside separate notifications from **Wee Care Pediatrics** and **Easterseals Northeast Indiana**. Legal and regulatory consequences continued to surface from earlier healthcare incidents. **Asheville Eye Associates** agreed to settle consolidated class-action litigation tied to a **Nov. 2024** attack claimed by **DragonForce ransomware**, which allegedly exfiltrated **~540 GB** before encrypting systems and later leaked data when ransom was not paid; the breach was reported to HHS OCR as affecting **204,984** individuals. Sector-wide reporting also indicated **46** large healthcare breaches logged for **Jan. 2026** on the HHS OCR portal (500+ individuals), exposing **~1.44 million** individuals’ PHI, amid discussion that late-2025 reporting backlogs may have influenced recent month-to-month trends.
Jun 29, 2026
Multiple healthcare-sector cyber incidents were reported, including ongoing fallout from a major U.S. provider ransomware event. **Kettering Health** continues to face escalating legal exposure from a 2025 ransomware attack attributed to **Interlock**, which allegedly stole **941 GB** of data and encrypted systems; the disruption forced shutdown of roughly **600 applications**, a temporary shift to paper workflows, and delays to care while systems (including *Epic* EHR) were restored. Dozens of patient lawsuits have been filed and consolidated in Ohio, with claims focused not only on data theft but also alleged **delayed or denied medical care** during the outage. Separately, healthcare vendor **Insightin Health** disclosed a 2025 security incident involving its use of the *GoAnywhere* managed file transfer tool, reporting that an unauthorized party accessed GoAnywhere by exploiting an **“unknown design flaw”** and potentially accessed files on a subset of servers between **Sept 17–23, 2025**; impacted data may have included names, provider names, insurance information, and member IDs (no SSNs or financial data reported). In Europe, the Independent Public Regional Hospital in **Szczecin, Poland** reported a March 2026 cyberattack that **encrypted parts of hospital data**, disrupted digital operations, and forced a temporary return to paper-based processes, while the hospital stated urgent care continued despite slower administration.
Jul 12, 2026
Multiple healthcare organizations and vendors reported **delayed patient notifications** after discovering unauthorized access to protected health information (PHI), in some cases more than a year after the underlying compromise. In Colorado, **Alpine Ear, Nose, and Throat (Alpine ENT)** notified **65,648** individuals that an attacker accessed and exfiltrated files containing PHI in an incident identified on **Nov. 19, 2024**; the **BianLian** ransomware group later claimed responsibility and posted the organization to its leak site. Exposed data was described as highly sensitive, including medical information and, for some individuals, **financial account data and payment card details** (including CVC/expiration) and **Social Security numbers**; Alpine ENT reported no confirmed identity theft at the time of notification and offered credit monitoring. Separately, **Bayada Home Health Care** disclosed exposure risk tied to a **third-party vendor (Doctor Alliance)** after Doctor Alliance reported unauthorized network access during **Oct.–Nov. 2025**, potentially affecting Home Health Certification and Plan of Care forms containing patient identifiers and clinical/insurance details (and **SSNs for a subset**). Bayada said it discontinued using Doctor Alliance and reported the matter to regulators. In another vendor-related incident, **TriZetto Provider Solutions (Cognizant)**—an insurance verification provider—suffered a cyberattack impacting PHI across multiple states; Oregon providers began notifying additional patients after the breach was reported as occurring in **Nov. 2024** but not discovered until **Oct. 2, 2025**, with no financial data reportedly compromised and no evidence of misuse so far; the incident has prompted **class-action lawsuits**, engagement of **Mandiant**, and law enforcement notification.
Jun 29, 2026