Loading story…
A former Nuance Communications IT worker, Max Vance (also known as Andre Vance), pleaded guilty in Pennsylvania federal court to obtaining information from a protected computer without authorization after allegedly downloading and storing ~1.2 million Geisinger Health patient records on a personal hard drive shortly after being terminated in 2023. Nuance (now part of Microsoft) was providing IT services to Geisinger at the time of the incident, and the criminal case was initially filed in January 2024.
Geisinger previously stated the exposed data included patient names, birthdates, addresses, medical record numbers, race, gender, phone numbers, and facility name abbreviations. Under the plea agreement, prosecutors agreed to dismiss additional charges related to alleged false statements to the FBI that had been added in a superseding indictment, and Vance agreed to forfeit a Samsung PSSD T7 external drive cited in the case.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
A federal court approved a $5 million class-action settlement related to the Geisinger breach. A final approval hearing was scheduled for March 16, 2026.
On February 27, 2026, Vance pleaded guilty in Pennsylvania federal court to unlawfully obtaining information from a protected computer. Under the plea agreement, prosecutors agreed to dismiss two false-statement charges and Vance agreed to forfeit a Samsung external drive alleged to contain the stolen data.
In February 2024, investigators arrested Vance in connection with the Geisinger data theft. During a property search, authorities reported finding electronic devices containing the stolen data as well as unregistered firearms, fake or blank IDs, and equipment for producing fake IDs.
Prosecutors filed the criminal case in January 2024, alleging that Max Vance unlawfully obtained information from a protected computer and copied Geisinger patient data after his termination. The case also initially included false-statement charges tied to FBI interviews.
Geisinger said it discovered the unauthorized access on November 29, 2023 and notified Nuance, triggering investigation of the insider breach. The incident involved Nuance's role as Geisinger's IT services provider and business associate.
Two days after being fired in 2023, former Nuance employee Max Vance allegedly used still-active access to download and store more than 1 million Geisinger Health patient records on a personal external hard drive. The data reportedly covered about 1.2 million patients and included identifiers such as names, birthdates, addresses, medical record numbers, and demographic details.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
hipaajournal.com
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
US healthcare data-breach litigation and enforcement activity saw multiple updates, including new criminal charges tied to the **2023 Geisinger Health** breach. Prosecutors filed a superseding indictment adding **two counts of false statements** against **Max Vance**, a former **Nuance Communications** employee accused of intentionally accessing a protected computer and obtaining **PHI for more than 1.3 million Geisinger patients** shortly after his termination; the new counts allege he lied to the FBI about downloading or storing unauthorized data on personal devices. Separately, two civil class-action matters reached settlement in breach cases involving patient data exposure. **Capital Health** agreed to a **$4.5M** settlement tied to a **2023 ransomware incident** in which intruders had network access for roughly two weeks and encrypted files; **LockBit** claimed responsibility and alleged **~7 TB** of data exfiltration, while Capital Health reported the incident to HHS OCR as affecting **503,071 individuals**. **Gryphon Healthcare** agreed to a **$2.87M** settlement (including a **$2.8M** fund) over a **2024 cyberattack** affecting a billing-services partner relationship, with **393,358 patients’ PHI** potentially viewed or obtained; the company denied liability but settled to avoid continued litigation costs and uncertainty.
Jun 29, 2026
A federal court has granted preliminary approval for a $5 million settlement in a class action lawsuit involving Geisinger Health and Nuance Communications following a significant insider data breach. The breach, which occurred in 2023, involved a former Nuance employee who accessed and stole sensitive patient information from Geisinger Health two days after his termination. The compromised data included names, Social Security numbers, dates of birth, medical information, and health insurance details for over 1 million patients. Notification to the 1.2 million affected individuals was delayed until June 2024 due to an ongoing law enforcement investigation. The settlement addresses both the class action litigation and the criminal case against the ex-Nuance worker. Geisinger Health, a major healthcare provider in Pennsylvania, and Nuance Communications, a Microsoft subsidiary, faced scrutiny for their handling of the breach and subsequent notification process. The incident highlights the risks associated with insider threats in healthcare and the importance of timely breach disclosure to affected individuals.
Jun 29, 2026
Multiple healthcare-related organizations disclosed **separate** incidents involving exposure or theft of patient data. Delta Medical Systems reported unauthorized access to its email environment on July 15, 2025, with potentially exposed data including names, dates of birth, Social Security numbers, driver’s license information, bank details, insurance information, and medical information. A separate HIPAA Journal report described additional incidents at Cedar Valley Services, Community Nurse, and Health Dimensions Group, including a likely **Qilin ransomware** intrusion at Cedar Valley Services and a vendor-linked compromise affecting Community Nurse through *Doctor Alliance*, where files may have been accessed between October 31 and November 17, 2025. In a different but related healthcare privacy matter, a judge approved a **$5 million settlement** in litigation against Geisinger Health and *Nuance Communications* over the theft of medical records affecting roughly **1.3 million patients** by a former Nuance employee. The stolen records reportedly included names, birthdates, addresses, medical record numbers, treatment details, and insurance information. While all three reports concern healthcare data exposure, they describe **distinct incidents** rather than one unified breach event, spanning direct compromises, third-party/vendor exposure, suspected ransomware activity, and post-incident legal resolution.
Jul 12, 2026