Loading story…
Madera Community Hospital disclosed a data breach affecting 150,810 individuals after an unauthorized party accessed its internal network for two days in late May 2025 and likely acquired files from part of the environment. The California hospital said the exposed information included names, contact details, dates of birth, Social Security numbers, login credentials, financial account information, treatment and health insurance data, and limited biometric information.
The hospital detected the intrusion on May 29, 2025, initially found no evidence of file theft during its early investigation, and later concluded that data had likely been exfiltrated. It said an extortion group was behind the incident and had issued a ransom demand before reportedly withdrawing it after learning the victim was a hospital and saying it did not want to harm patients. Madera Community Hospital said it secured the affected network, hired third-party cybersecurity and data-review firms, notified law enforcement and the US Department of Health and Human Services, and began notifying affected individuals in mid-July 2026 after receiving data-review results in April 2026.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
Madera Community Hospital began notifying potentially impacted individuals in mid-July 2026. The hospital ultimately reported to the U.S. Department of Health and Human Services that 150,810 people were affected.
Madera Community Hospital said it received the results of its data review in April 2026. After that, it worked to ensure accurate contact information for potentially impacted individuals.
A forensic investigation in June 2025 determined that an unauthorized third party had access to the hospital's computer network for two days in late May 2025. The initial investigation did not identify any files as having been taken.
Madera Community Hospital identified unauthorized access to its internal network on May 29, 2025. It launched an investigation, secured the affected network, engaged external cybersecurity experts, and notified law enforcement.
Subsequent developments led Madera Community Hospital to believe that files from part of its network were acquired by the intruder. The hospital identified potentially exfiltrated files and said the compromised data included personal, financial, medical, insurance, credential, and limited biometric information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple healthcare organizations disclosed **data security incidents** involving potential exposure of patient and personal information. Jackson Hospital and Clinic (Montgomery, Alabama) notified **14,485** individuals about a breach at its former debt-collection vendor **Nationwide Recovery Services**, where suspicious activity was identified in July 2024 and an unauthorized party accessed the vendor’s network between **July 5–15, 2024**. Jackson Hospital stated its own IT systems were not affected, but data shared for collections work may have been compromised, including **names, contact details, dates of birth, Social Security numbers, account/insurance information, and dates of service**; affected individuals were offered credit monitoring and identity theft protection. Separately, **Community Health Action of Staten Island** reported a data security incident that may have involved unauthorized access to sensitive personal and medical information, and **Insight Hospital and Medical Center** (Chicago) reported a cyber incident involving unauthorized access to its network between **Aug. 22 and Sept. 11, 2025**, with potential exposure of patient and financial data. The disclosures underscore ongoing third-party and direct-network intrusion risks in the healthcare sector, with notification timing and scope varying by organization and investigation status.
Jun 29, 2026
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026
Brown Health Medical Group-MA disclosed a data breach affecting **311,760 individuals** after unauthorized activity was discovered on a legacy file server at its Hawthorn location in December 2025. The organization said the intrusion was limited to that historic file server and did **not** affect its electronic medical record or electronic health record systems, but a June 22, 2026 review found that files on the server had been accessed. The exposed information potentially included names, contact details, dates of birth, Social Security numbers, driver’s license and other government ID numbers, medical and disability records, financial account information, payment card data, and employment-related records. Brown Health Medical Group-MA reported the incident to the **HHS Office for Civil Rights** and state authorities in Massachusetts and Vermont, said no threat actor had been publicly identified or linked to a ransomware or extortion claim, and is offering affected individuals **24 months** of credit monitoring, fraud detection, and identity theft protection services.
Aug 6, 2026