Loading story…
A hacker allegedly compromised Massachusetts HVAC vendor ENE Systems and claimed the intrusion provided access into customer environments, including Boston Children’s Hospital. According to reporting cited by DataBreaches.net, the attacker attempted to extort the vendor, said the ransom was not paid, and shared screenshots as proof while asserting continued access to ENE Systems and some client networks. Boston Children’s Hospital and Mass General Hospital acknowledged vendor-related cybersecurity concerns but said operations were not disrupted, and Boston Children’s said no patient data were affected.
The incident renewed scrutiny of HVAC and facilities contractors as a supply-chain entry point into larger organizations. The reporting drew parallels to the Target breach, where HVAC contractor Fazio Mechanical Services said its remote connection to Target was limited to billing, contract submission, and project management rather than direct control of heating or refrigeration systems. Fazio said it was a victim of a sophisticated attack, was cooperating with investigators, and that no other customers were affected, underscoring how trusted vendor access can expose hospitals and retailers alike to downstream compromise.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
Boston Children's Hospital and Mass General Hospital acknowledged cybersecurity concerns related to the vendor incident. Boston Children's said operations were unaffected and no patient data were impacted, while both hospitals indicated there was no disruption to care.
The alleged ENE Systems intruder said the compromise provided access into client environments, including Boston Children's Hospital, and shared screenshots as proof. The claims suggested a supply-chain style intrusion path through the HVAC vendor.
A hacker allegedly breached Massachusetts-based HVAC vendor ENE Systems and claimed to have maintained access to the vendor's environment. According to the report, the attacker attempted to extort ENE Systems, but the ransom was not paid.
Fazio Mechanical Services publicly stated that its remote connection to Target was limited to billing, contract submission, and project management, not HVAC monitoring or control. The company said no other customers were affected, it was cooperating with the U.S. Secret Service and Target, and it was not the subject of the federal investigation.
Attackers used access associated with HVAC contractor Fazio Mechanical Services in the intrusion that led to the Target data breach. The incident became a prominent example of third-party or supply-chain compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026
Three Asheville-area skilled nursing and rehabilitation facilities affiliated with Ascent Healthcare Management disclosed that a threat actor accessed systems or accounts between **November 25 and November 28, 2025**, exposing files tied to an unnamed trusted vendor. The affected organizations—**Bear Mountain Health and Rehabilitation**, **Elevate Health & Rehabilitation**, and **Swannanoa Valley Health & Rehabilitation**—said the compromised information included extensive personal data and protected health information, and they began notifying affected residents on **July 31**. The breach was separately reported to HHS, with **1,397**, **1,551**, and **1,045** individuals affected across the three facilities. A Massachusetts template notice reportedly stated that the intrusion involved login credentials stolen from another unnamed trusted vendor, while the facilities told victims there was **"credible evidence"** the stolen files had been permanently deleted and would not be published; that assurance drew scrutiny because of the long gap between the intrusion and notification and the limited transparency around the attackers and access path.
Aug 24, 2026
The US Department of Health and Human Services (**HHS**) is increasing scrutiny of **third-party service provider** cybersecurity in the healthcare sector following the 2024 **Change Healthcare** cyberattack, which HHS officials describe as having threatened the “liquidity” of the broader healthcare system. HHS’s Charlee Hess (Administration for Strategy Preparedness and Response) said the incident exposed previously underappreciated systemic risk from external vendors that can have outsized sector-wide impact, and noted HHS is working through a methodology—alongside industry—to identify where those critical third-party dependencies and risk concentrations exist. Reporting reiterated that the Change Healthcare intrusion began with attackers exploiting the lack of **multi-factor authentication (MFA)** on a remote access portal and ultimately exposed data affecting roughly **190 million** people. The breach has also driven broader government and industry responses, including proposals for mandatory cybersecurity requirements on hospitals (which healthcare organizations have opposed as burdensome, arguing the Change Healthcare compromise originated with an external vendor) and remediation actions by **UnitedHealth Group** (Change Healthcare’s parent) to “start over” on aspects of its systems and technology environment.
Jun 29, 2026