Loading story…
Saint Anthony Hospital in Chicago disclosed that unauthorized actors accessed and/or stole files and folders containing unstructured data from its email system on February 27, 2025, exposing sensitive information tied to 146,108 individuals. The hospital said its electronic medical records were not affected, but the compromised data included names, addresses, dates of birth, Social Security numbers, medical record numbers, patient account numbers, prescription information, and medical histories.
The incident was initially reported as affecting about 6,600 patients and employees, but a later filing with the HHS Office for Civil Rights sharply increased the total impact. Third-party specialists completed their review on February 13, 2026, and notification letters began mailing on March 6, 2026, more than a year after the intrusion. Saint Anthony said it found no evidence of actual or attempted misuse of the data, while urging affected individuals to monitor credit reports, financial accounts, and explanation of benefits statements; reports indicate complimentary credit monitoring and identity theft protection were not offered.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
By April 2026, a breach notice filed with the HHS Office for Civil Rights indicated the incident affected 146,108 individuals, sharply increasing the known scope from the hospital's earlier estimate. Reporting also noted that complimentary credit monitoring and identity theft protection did not appear to have been offered.
Saint Anthony Hospital began sending notification letters to affected individuals on March 6, 2026, more than a year after the unauthorized access. The hospital said it found no evidence of actual or attempted misuse and advised recipients to monitor credit, financial, and benefits statements.
Third-party specialists completed their review of the breach on February 13, 2026. The completed review led to a much larger confirmed impact than initially reported.
In November 2025, Saint Anthony Hospital initially disclosed the incident as affecting roughly 6,600 patients and employees. The exposed data was described as including names, addresses, dates of birth, Social Security numbers, medical record numbers, patient account numbers, prescription information, and medical histories.
On February 27, 2025, Saint Anthony Hospital said unauthorized actors accessed and/or stole files and folders of unstructured data from its email system. The hospital stated its electronic medical records were not affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple healthcare organizations disclosed **data security incidents** involving potential exposure of patient and personal information. Jackson Hospital and Clinic (Montgomery, Alabama) notified **14,485** individuals about a breach at its former debt-collection vendor **Nationwide Recovery Services**, where suspicious activity was identified in July 2024 and an unauthorized party accessed the vendor’s network between **July 5–15, 2024**. Jackson Hospital stated its own IT systems were not affected, but data shared for collections work may have been compromised, including **names, contact details, dates of birth, Social Security numbers, account/insurance information, and dates of service**; affected individuals were offered credit monitoring and identity theft protection. Separately, **Community Health Action of Staten Island** reported a data security incident that may have involved unauthorized access to sensitive personal and medical information, and **Insight Hospital and Medical Center** (Chicago) reported a cyber incident involving unauthorized access to its network between **Aug. 22 and Sept. 11, 2025**, with potential exposure of patient and financial data. The disclosures underscore ongoing third-party and direct-network intrusion risks in the healthcare sector, with notification timing and scope varying by organization and investigation status.
Jun 29, 2026
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026
NYC Health + Hospitals disclosed that attackers accessed its network for nearly three months and copied sensitive files affecting about **1.8 million** people. The intrusion reportedly began around **November 25, 2025** and continued until **February 11, 2026**, with suspicious activity first detected on **February 2**. The organization said the breach appears to have originated through a compromised third-party vendor and later reported the incident to the U.S. Department of Health and Human Services Office for Civil Rights. Stolen information included personal and medical records, insurance and billing details, payment data, government-issued identifiers, precise geolocation data, and biometric data such as **fingerprints** and **palm prints**, raising particular concern because biometric identifiers cannot be reissued once exposed. NYC Health + Hospitals said it engaged external cybersecurity specialists, reset affected credentials, added security technologies, strengthened monitoring and detection rules, updated remote access controls, and is offering **two years** of Kroll identity theft protection and credit monitoring to affected patients and employees.
Jun 29, 2026