Loading story…
Nacogdoches Memorial Hospital in Texas disclosed that a January cyberattack exposed the personal and medical information of 257,073 patients after attackers gained access to its network on January 15 and remained undetected for roughly two weeks. Public reporting and breach notification materials indicate the stolen data included names, Social Security numbers, medical record numbers, health insurance and health plan beneficiary details, and other sensitive healthcare information; the hospital also said patient photos may have been affected.
The regional medical center said it has not identified misuse of the stolen data so far, but the scale and sensitivity of the breach make it a significant healthcare privacy incident. In response, the hospital said it implemented additional network security measures and security awareness training, while reports noted it did not offer complimentary credit monitoring to affected individuals and did not provide further detail on the intrusion or whether employee and support staff data was also compromised.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Following the incident, Nacogdoches Memorial Hospital said it added network security improvements and security awareness training. The hospital did not offer complimentary credit monitoring to affected individuals.
The hospital disclosed that 257,073 patients had personal and medical information stolen, including Social Security numbers, medical record numbers, health plan beneficiary numbers, and possibly patient photos. It said there was no indication of misuse at the time of disclosure.
The hospital discovered the breach roughly two weeks after the initial compromise. The incident was found in late January 2026 after attackers had already accessed sensitive data.
Nacogdoches Memorial Hospital said threat actors gained access to its network on January 15, 2026. The intrusion led to unauthorized access to patient personal and medical information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Nacogdoches Memorial Hospital, an independent health system in Texas, disclosed a cyberattack that exposed sensitive information belonging to **257,073 individuals**. The hospital said staff identified an ongoing intrusion on January 31, while a filing to Maine indicated the incident date was January 15, creating some uncertainty around the precise timeline of the breach. The compromised data may include names, contact information, **Social Security numbers**, dates of birth, medical record numbers, account numbers, health plan beneficiary numbers, and in some cases full-face photographs. Reporting indicated the incident had not yet appeared on the U.S. Department of Health and Human Services public breach portal at the time of disclosure, and it remained unclear whether the total affected population included only patients or also employees.
Jun 29, 2026
Multiple healthcare organizations disclosed **data security incidents** involving potential exposure of patient and personal information. Jackson Hospital and Clinic (Montgomery, Alabama) notified **14,485** individuals about a breach at its former debt-collection vendor **Nationwide Recovery Services**, where suspicious activity was identified in July 2024 and an unauthorized party accessed the vendor’s network between **July 5–15, 2024**. Jackson Hospital stated its own IT systems were not affected, but data shared for collections work may have been compromised, including **names, contact details, dates of birth, Social Security numbers, account/insurance information, and dates of service**; affected individuals were offered credit monitoring and identity theft protection. Separately, **Community Health Action of Staten Island** reported a data security incident that may have involved unauthorized access to sensitive personal and medical information, and **Insight Hospital and Medical Center** (Chicago) reported a cyber incident involving unauthorized access to its network between **Aug. 22 and Sept. 11, 2025**, with potential exposure of patient and financial data. The disclosures underscore ongoing third-party and direct-network intrusion risks in the healthcare sector, with notification timing and scope varying by organization and investigation status.
Jun 29, 2026
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026