Craneware Breach Exposes Employee and Customer Data at Major US Hospital Software Provider

Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.

Mar 3, 2026

Recent Data Breaches at U.S. Healthcare Providers

Multiple U.S. healthcare organizations have recently disclosed data breaches resulting from unauthorized access to sensitive patient information. Expert MRI, a radiology provider in California, reported that an attacker accessed its network between June and August 2025, exfiltrating data such as names, addresses, dates of birth, diagnoses, and, for some, Social Security numbers. The PEAR threat group claimed responsibility and briefly listed stolen data on its leak site, suggesting a ransom may have been paid. Revere Health in Utah experienced a breach of a third-party payment platform, potentially exposing patient names, dates of birth, addresses, medical record numbers, and partial Social Security numbers, though no evidence of misuse was found. Health Management Systems of America in Michigan disclosed a breach after an employee fell victim to a spear phishing attack, resulting in the unauthorized download of emails containing patient data. These incidents highlight the ongoing risks faced by healthcare organizations from both targeted ransomware groups and opportunistic phishing attacks. In response, affected providers have reported the breaches to regulators, enhanced their cybersecurity measures, and offered credit monitoring to impacted individuals. The number of affected patients varies by incident, with Revere Health reporting up to 10,800 impacted and Expert MRI yet to disclose a total. The breaches underscore the importance of robust security practices and employee awareness training to mitigate the risk of data compromise in the healthcare sector.

Dec 17, 2025

Multiple Healthcare Data Breaches Impacting U.S. Medical Providers

Several U.S. healthcare organizations have disclosed significant data breaches involving unauthorized access to patient and employee information. MedStar Health reported that an unauthorized third party accessed internal systems containing sensitive patient data, including names, dates of birth, Social Security numbers, and medical information. The Rhysida threat group claimed responsibility for this attack, alleging the exfiltration and leak of over 7 million pieces of patient data. Brevard Skin and Cancer Center also confirmed a cyberattack in which the Pear threat group claimed to have stolen 1.8 terabytes of data, affecting both patient and employee records with information such as Social Security numbers, health conditions, and billing details. Both organizations have offered complimentary credit monitoring and identity theft protection to affected individuals and are reviewing their cybersecurity measures. Henry Ford Health in Michigan disclosed an insider data breach affecting nearly 2,000 patients, resulting in the termination of the responsible employee and notification to those impacted. While details on the specific data accessed were not provided, credit monitoring services have been offered. These incidents highlight the ongoing risks faced by healthcare providers from both external threat actors and insider threats, emphasizing the need for robust security policies and continuous evaluation of protective measures to safeguard sensitive health information.

Dec 12, 2025

Craneware Breach Exposes Employee and Customer Data at Major US Hospital Software Provider

How this story unfolded

Craneware reports incident to regulators and law enforcement

Craneware discloses cyber incident and data theft

Related entities

Organizations

Breaches

Sources

See the full picture, correlated to your attack surface.

Craneware Breach Exposes Employee and Customer Data at Major US Hospital Software Provider

How this story unfolded

Craneware reports incident to regulators and law enforcement

Craneware discloses cyber incident and data theft

Related entities

Organizations

Breaches

Sources

See the full picture, correlated to your attack surface.

Craneware Breach Exposes Employee and Customer Data at Major US Hospital Software Provider

How this story unfolded

Craneware reports incident to regulators and law enforcement

Craneware discloses cyber incident and data theft

Related entities

Organizations

Breaches

Sources

See the full picture, correlated to your attack surface.

Related stories

Healthcare Data Breaches and Patient Record Exposure at Providers and Vendors

Recent Data Breaches at U.S. Healthcare Providers

Multiple Healthcare Data Breaches Impacting U.S. Medical Providers

Craneware Breach Exposes Employee and Customer Data at Major US Hospital Software Provider

How this story unfolded

Craneware reports incident to regulators and law enforcement

Craneware discloses cyber incident and data theft

Related entities

Organizations

Breaches

Sources

See the full picture, correlated to your attack surface.

Related stories

Healthcare Data Breaches and Patient Record Exposure at Providers and Vendors

Recent Data Breaches at U.S. Healthcare Providers

Multiple Healthcare Data Breaches Impacting U.S. Medical Providers