Data Breaches
Another healthcare-sector cloud-compromise disclosure — sector-advisory work this week. AdaptHealth says attackers reached its cloud systems and accessed patient data, with social engineering reported as the initial-access route.
Healthcare Cybersecurity
Another healthcare-sector disclosure at scale — a single phishing email at an AI utilization-management vendor exposed the protected health information of nearly 1.4 million patients, and it reads as sector-advisory work for the week.
Healthcare Cybersecurity
A medical-device company's patient-records disclosure — sector-advisory work begins. iRhythm told the SEC a threat actor obtained patient protected health information from third-party-hosted business applications, and judged the incident material.
Nation-State Cyber Threats
GTIG's published research resets sector advisory work for research organizations across North America, putting REDCap servers and Google Workspace administrative rules at the top of the review list.
Data Breaches
Pharma giant Novo Nordisk discloses a clinical-trial data theft on the same day UK regulators greenlight its Wegovy pill — a reminder of the sector's persistent threat profile.
Data Breaches
DentaQuest, a Sun Life dental-benefits administrator serving 35 million people, confirmed a breach of 2.6 million accounts after ShinyHunters leaked about 234 GB of data — including names, dates of birth, Medicaid IDs and health-insurance information.
Data Breaches
Three breach disclosures landed in one cycle — Radiology Associates of Richmond (266,183 people), DocketWise (143,480), and a vendor breach at the Oncology Institute. None is a novel attack. Together they map 2026's two structural failures: repeat victimization and third-party risk.
Data Breaches
Cerner discovered the breach in February 2025. Atrium Health patients only learned this week. The 15-month gap — across 16 health systems through one Oracle-owned vendor — is the year's clearest HIPAA business-associate accountability test.
Trending
More than 40 million people ask ChatGPT a healthcare-related question every day. OpenAI's ChatGPT Health and Anthropic's Claude for Healthcare are not HIPAA-compliant for consumers — and that is by design.
Policy & Government
The breach didn't need a hack. It needed an interoperability framework that took fake clinics at their word.
Ransomware
Sandhills Medical Foundation discloses a ransomware breach by Inc Ransom affecting 169,017 patients — nearly 12 months after the attack was detected and 10 months after stolen data was published publicly.
Data Breaches
Medtronic says an unauthorized party accessed data in “certain corporate IT systems,” validating claims by the ShinyHunters extortion group that it stole more than 9 million records of personally identifiable information from the medical-device giant. DUBLIN, IRELAND — Medtronic, the global heavyweight in medical technology, has officially moved from investigation