Loading story…
The Orova extortion group has listed Cardiology Associates of Port Huron (CAPH), a Michigan cardiology practice with nine locations, as an alleged victim and claims it stole 256,382 files totaling about 496 GB before encrypting some servers. CAPH has not publicly confirmed or denied the reported June 2026 incident. Orova says the practice could restore affected systems from backups and had prepared the alleged data for public release.
A review of a password-protected archive reportedly found apparently authentic patient information affecting roughly 145,846 to 150,380 people, including as many as 124,893 unique Social Security numbers. The purported leak contains protected health information, clinical and radiology records, insurance and claims data, remittance advice, and contact details, creating risks of identity theft, insurance fraud, and targeted scams; if CAPH knew of a breach by June 25, HIPAA notification requirements may apply.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
DataBreaches reported that CAPH appeared to have been breached by the Orova extortion group.
Orova reportedly posted CAPH, a Michigan cardiology practice with nine locations, on its leak site, including screenshots said to show personally identifiable information and protected health information.
Orova told DataBreaches that it breached Cardiology Associates of Port Huron (CAPH) on June 25, 2026, exfiltrated data, and encrypted some servers. CAPH had not publicly confirmed or refuted the alleged incident.
DataBreaches reviewed a password-protected archive and assessed Orova's claims as appearing accurate, while noting it could not verify every record. Its analysis identified up to 150,380 patient records and 124,893 unique Social Security numbers in a backup dated June 14, 2026.
Orova revised its alleged CAPH theft total from 244,215 files totaling 144 GB to 256,382 files totaling about 496 GB, including a claimed 400 GB backup. The group hosted an alleged CAPH archive split into 70 password-protected parts and was preparing to release the password.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Orova** ransomware group has claimed a widening set of victims across the United States, Hong Kong, and the UK, hitting organizations in healthcare, manufacturing, financial services, professional services, religious institutions, community associations, and agriculture. Reported victims include **Integrated Site Management**, **Tat Fung Textile Co., Ltd.**, **JK Capital Management Limited**, **Global Friction Products**, **Conceptual Designs**, **Stonecrest POA**, **Stoneybrook West Master Association**, **St Theresa Catholic Church**, **Country Oaks Veterinary Clinic**, **Magnolia Dental**, **Woodside Ranch**, **David King Architect**, **First Baptist Church of Belleview**, **Gemstone UK**, and **Hilliard’s Air Conditioning & Heating**. One notable claim involved **FixIT Tek**, where Orova allegedly compromised a **Syncro MSP panel** and stole client data, raising the prospect of downstream exposure through a managed service provider environment. Separate reporting indicates Orova is operating as a newly observed **ransomware-as-a-service** group and may be a branch of a previously vanished operation. In healthcare, the group has listed **Wisdom Oral Surgery**, **Magnolia Dental**, and **Cardiology Associates of Port Huron** on its leak site; for the Michigan cardiology practice, Orova claimed to have stolen more than **244,000 files** totaling **144 GB** after a June intrusion and published screenshots that allegedly exposed **PII**, **PHI**, insurance records, and at least one full Social Security number. The breadth of victims and the publication of sensitive medical data suggest Orova is combining encryption and data-theft extortion while rapidly building a leak-site presence around smaller and midsize organizations.
Aug 6, 2026
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026
ApolloMD, a US-based healthcare services and practice management provider and HIPAA business associate, disclosed that a May 2025 cyberattack led to unauthorized access to its IT environment and potential theft of patient data affecting **626,540** individuals. ApolloMD reported detecting unusual activity on **May 22, 2025**, and its investigation concluded an unauthorized party accessed systems between **May 22–23, 2025**, including files tied to patients treated by affiliated physicians and practices; the incident was later reflected in US HHS breach reporting. Exposed data varied by individual but included **names, dates of birth, addresses, diagnoses, treatment details/dates of service, provider names, health insurance information**, and for some, **Social Security numbers**. Reporting also linked the incident to the **Qilin ransomware** group, which publicly listed ApolloMD on its leak site in June 2025 and claimed exfiltration of **238 GB** (posting limited proof screenshots not showing patient data); ApolloMD’s public notice did not confirm ransomware, encryption, or a ransom demand. ApolloMD notified affected client practices between **July–September 2025**, issued patient letters in mid-September 2025, and posted a substitute notice later that month, including a list of impacted managed physician practices.
Jun 29, 2026