healthcare
9 articles with this tag
Asahi Kasei Therapeutics healthcare-professional site breach (about 514,000 people): what may have leaked and what doctors, pharmacists and nurses should do
On October 6, 2026, Asahi Kasei Therapeutics Co. Ltd., the pharmaceutical arm of Japan's Asahi Kasei group, announced that Pharma DIGITAL, its information site for healthcare professionals, had been hit by a cyberattack and that personal data in its member database may have been viewed or taken. The data covers about 514,000 healthcare professionals (name, facility name, facility address, job type, specialty and more), about 44,000 of them with email addresses and more in addition to those items, and about 700 company employees (name, email address, photo). The company learned of the access from the site's contractor on October 2 and shut the site down. It says it did not store credit card data or sensitive personal data such as medical history, and as of October 6 no misuse had been found. This site's take: expect fake emails posing as drug companies, academic societies or seminar invitations. Never log in from email links, and change any password you reused from this site.
DC Medicaid data exposure (about 400,000 people): Medicaid IDs left in published reports — what members and report publishers should do
The District of Columbia Department of Health Care Finance (DHCF), which runs DC Medicaid, said two statistical reports posted on its website from 2023 to July 2026 contained the underlying personal data in hidden fields that people without permission could access. The data included Medicaid ID numbers, dates of birth, provider names, race, gender, ward and ethnicity; DHCF says beneficiary names, Social Security numbers and financial account information were not included. DHCF learned of the issue on July 21, 2026 and removed the reports. Its report to the US Department of Health and Human Services (HHS) lists 399,086 people. Our conclusion: a report that shows only totals on screen can still carry the source data inside the file. Members should watch for medical services they never received; publishers should rebuild public files so that they never contain the source rows.
MyDr Patient Data Breach in Poland (Up to 18.8 Million): PESEL, Health Data and Contacts Exposed — What Affected People Should Do
In August 2026, MyDr sp. z o.o., whose electronic medical records software is used by more than 12,000 healthcare facilities in Poland, disclosed that an external criminal act let a third party copy the contents of a database stored in its cloud. The data is mainly historical, from before April 12, 2024, and Poland's Ministry of Digital Affairs said up to 18.8 million people and over 12,000 facilities may be affected. According to the company, the items include name, address, contact details, PESEL (national identification number), health data, social insurance information and employer details, though not every item applies to every patient. The cause and the route of entry have not been disclosed. The government lets people check whether their PESEL is involved at bezpiecznedane.gov.pl and urges everyone to reserve their PESEL (zastrzeżenie PESEL). This site's take: when one software vendor holds patient data for thousands of facilities, a single breach reaches all of them, and this time what was copied was a backup more than two years old. Affected people should check, reserve their PESEL and prepare for threats that mention their health; operators should confirm that old backups are protected as well as production.
AdaptHealth data breach (about 4.1 million people): health insurance and health data exposed — patients should check benefit statements and calls
AdaptHealth, a US provider of home medical equipment, says a June 5, 2026 cyberattack exposed patients' names, contact information, demographic information, health insurance information and health information. Its report to the US Department of Health and Human Services (HHS) covers 4,115,802 people. According to the company, Social Security numbers (SSNs), financial account and card information were not involved, and it is not aware of any misuse. Its July 2 report to the Securities and Exchange Commission (SEC) says the cause was a social engineering attack (tricking people into giving information or access) that compromised a user session associated with a third-party contractor; a stored password file associated with insurance billing was taken and external electronic health record portals were accessed. Our view: with no SSNs, the priority is reading Explanation of Benefits statements for care or equipment you did not receive, and not giving insurance numbers to callers about supply reorders. For organizations, the lesson is how far one contractor account can reach.
Cegedim Santé Patient Data Breach (About 15 Million): What Patients and Clinics Should Do When Medical Software Leaks
Cegedim Santé, the Cegedim Group subsidiary that publishes software for healthcare professionals in France, said on February 26, 2026 that at the end of 2025 it identified abnormal application request behaviour on the accounts of doctors using its MLM (MonLogicielMedical.com) software. Of the 3,800 doctors using MLM, 1,500 were affected, and personal data of patients in the MLM database was illegally accessed or extracted. The data comes from the patient's administrative file (name, gender, date of birth, phone number, address, email) and administrative comments written in free text at the doctor's discretion. For a very limited number of patients, those comments may have contained the doctor's personal notes about sensitive information. The company says structured medical records remained intact. France's Ministry of Health was reported to put the number of patients who may be concerned at about 15 million, with about 1% involving sensitive notes. When one cloud vendor stores the patient data of thousands of practices, a breach affects every practice using the software, not just one clinic. The most sensitive data sat in a field with the harmless-sounding label 'administrative comment'. Patients should prepare for impersonation and pressure messages. Clinics should check what goes into free-text fields and who would notice unusual activity on each doctor's account.
Four Hospitals Disrupted by Cyberattacks in 2026: What Stopped, and What Patients and Hospitals Should Do
In 2026, cyberattacks disrupted care at hospitals in the US, Belgium and Japan. Laid side by side, the hospitals' own statements show one pattern: inpatient and emergency care continued on paper under downtime procedures, while outpatient clinics, chemotherapy, the hospital pharmacy, appointment phones, the patient portal, ambulance intake and imaging stopped — the functions that connect a hospital to the outside. Downtime procedures should be written for those outward-facing functions, not only for the wards. The way in can be equipment nobody counts as a clinical system, such as a VPN appliance used to maintain medical devices. Patients should check official channels, take urgent medication needs to the hospital's designated line, and not answer suspicious calls claiming to be the hospital.
Six US Healthcare Data Breaches of 2026: How to Check a Notice from a Company You Don't Know
In 2026 a string of US healthcare data breaches happened at companies most patients have never heard of. Lining up six cases from the HHS breach portal: four are business associates that do work for providers and plans, one is a lab that receives samples and data from providers, and the sixth is a hospital system that says the unauthorized actor may have gotten in through a security breach at a third-party vendor. This site's take: a notice from a company you don't know is not, by itself, evidence of a scam. Before you use any number or link in it, open the HHS breach portal and your state attorney general's breach listing yourself and compare. For organizations, start with three things: a list of everyone you've handed patient data to, confirmation of return or destruction when a contract ends, and MFA that can't be phished.
Tsurugi Handa Hospital ransomware (2021) — an unpatched VPN CVE and backups encrypted along with production
The way in, per the expert committee's report, was an internet-facing VPN device left unpatched against a known vulnerability (CVE-2018-13379), reachable with leaked credentials. Short passwords, no account lockout, and users holding admin rights made it easy to spread to other machines in the hospital (lateral movement). Decisively, the primary system and its backup were on the same network and both were encrypted. A backup that isn't isolated and offline can't be relied on for recovery. EMR recovery took about two months. Defend by patching internet-facing VPNs fast, revoking leaked/reused credentials, and keeping isolated, offline, 3-2-1 backups.
Osaka General Medical Center ransomware (2022) — a contractor's VPN as the way in, and hospital BCP
The way in was not the hospital itself but a meal-service contractor's remote-maintenance VPN device, which was unpatched and reachable using leaked credentials, the investigation committee found. Because the hospital and contractor were constantly connected, and because servers/PCs shared passwords, users held broad admin rights, EMR servers lacked antivirus, and the network wasn't segmented, the encryption spread across the EMR system. Outpatient care, surgery, and emergency intake were restricted; full recovery took over two months. Defend by treating contractor links as your own attack surface: patch internet-facing VPNs, end credential reuse, least privilege, segment, and build a medical BCP (paper fallback, tested restore).