Loading story…
Houston-based healthcare facilities operator Nutex Health disclosed that unauthorized actors accessed its network and exfiltrated files containing patient, employee, provider, business, and confidential financial information. The company said it is investigating the incident, including the affected data volume and operational impact, and reported no identified material impact to business operations or financial-reporting systems.
Attackers are extorting Nutex and have threatened to publish the stolen data. The Gentlemen ransomware-as-a-service group, also tracked as Storm-2697, claimed responsibility by listing Nutex on its leak site, though Nutex has not independently confirmed the attribution. A proposed Texas class-action lawsuit alleges that personally identifiable information and protected health information were compromised.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
The Gentlemen, also tracked as Storm-2697, added Nutex Health to its Tor-based leak site and claimed responsibility for the breach. The group threatened to release allegedly stolen Nutex data within nine days; Nutex did not independently identify the group as responsible.
In an August 31 SEC filing, Nutex Health confirmed that an unauthorized party exfiltrated private or confidential patient, employee, provider, business, and financial information. The company said it would notify affected patients, monitor for online leaks, and had not identified a material effect on operations or financial-reporting systems.
Nutex Health initially disclosed to the SEC that cybercriminals breached its servers and stole data. The company said it had engaged cybersecurity experts and was investigating the scope and business impact, with no material impact on operations or financial-reporting systems identified at that time.
A proposed class-action complaint was filed in Texas on behalf of people whose personally identifiable information or protected health information was allegedly compromised in the incident. Nutex said it could not predict the litigation's outcome or financial and operational effects.
Unauthorized actors accessed Nutex Health's network and exfiltrated files containing patient, employee, provider, business, and financial information. The attackers threatened to publish the stolen data externally.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
6 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcesecuritymagazine.com
Open sourceinfosecurity-magazine.com
Open sourcetherecord.media
Open sourcesecurityweek.com
Open sourcecyberveille.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Nutex Health, a Houston-based healthcare services and hospital-operations company, disclosed that an unauthorized third party accessed its network and exfiltrated files from certain servers. The potentially exposed information may include confidential or private data involving patients, employees, providers, business and financial operations, and intellectual property; the company is still determining the exact data types and affected individuals or partners. The company activated its incident-response plan, retained external forensic specialists, implemented containment measures, and notified law enforcement. Nutex said the attacker could leak the stolen data, although no threat group had publicly claimed responsibility. As of its disclosure, Nutex reported no material impact on operations or financial-reporting systems and does not expect a material effect on its strategy, financial condition, or operating results.
Aug 27, 2026
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026
Healthdaq, a Dublin-based recruitment platform used by Northern Ireland health trusts and other public health bodies, disclosed unauthorized access to its systems after attackers linked to the **XP95** extortion group claimed to have stolen nearly half a million files. Reported exposed data includes names, contact details, CVs, qualifications, passport copies, other government-issued identification, criminal background checks, vaccine records, forms, and in some cases health information. Healthdaq said it detected the breach on 30 March, contained the incident, and notified regulators and law enforcement, including the Garda National Cyber Crime Bureau, while the UK Information Commissioner's Office said it is assessing the company’s report. The incident prompted heightened alerts across Northern Ireland health trusts because of the volume and sensitivity of the compromised records and the risk of identity theft, fraud, and misuse of personal information. Reporting indicates Healthdaq received a ransom demand, and threat intelligence describes XP95 as a newly observed actor using a **pure data theft and extortion** model rather than file-encrypting ransomware; its first publicly identified victim was Eholo Health, a Spanish mental health SaaS provider serving psychologists in Spain and Andorra. The breach also underscored broader pressure on healthcare technology suppliers after a separate attack on Dutch EPD vendor ChipSoft disrupted hospital services and triggered parliamentary scrutiny over sector dependence on a small number of critical vendors.
Jun 29, 2026