In July 2026, 77 healthcare data breaches affecting 500 or more individuals were reported to the U. S. Department of Health and Human Services (HHS) Office for Civil Rights.
July was the third consecutive month in which large healthcare data breaches increased, with a month-over-month increase of 10%. Last year was a record-breaking year for healthcare data breaches. The OCR data breach portal currently shows 806 large healthcare data breaches in 2025 – an increase of 8.
6% from 2024. While 2026 was looking like there would be a fall in large healthcare data breaches, the year-to-date figures now suggest otherwise. The exact same number of data breaches are listed on the OCR data breach portal for January to July as this time in 2025, and it is likely that some breaches have yet to be added to the portal.
July was the worst month since October 2025 in terms of individuals affected by healthcare data breaches. Across the 77 large data breaches, the protected health information of at least 33,485,970 individuals was exposed or impermissibly disclosed – an increase of 642% from June 2026, and 154% higher than the 12-month average of 13. 2 million individuals per month.
The year-to-date figures show an increase in breach severity year-over-year. Between January and July 2026, the protected health information of 67,400,422 individuals was exposed or impermissibly disclosed; an increase of 35. 1% from this time last year.
Get The FREE HIPAA Compliance Checklist Immediate Delivery of Checklist Link To Your Email Address Please enable JavaScript in your browser to complete this form. Business Email * Name * First Last Number * Company Name * Get Free Checklist Please Enter Correct Email Address Your Privacy Respected HIPAA Journal Privacy Policy Biggest Healthcare Data Breaches in July 2026 In July, 23 security incidents were reported to OCR involving the protected health information of 10,000 or more individuals, including four very large data breaches that each affected more than 1 million individuals.
One of the incidents was the 4 th largest healthcare data breach of all time to be reported by a single HIPAA-regulated entity, affecting an estimated 15 million individuals. The four biggest healthcare data breaches in July affected more than 32 million individuals – more than 9% of the population of the United States. The largest data breach occurred at DentaQuest, a Sun Life U.
S-owned dental and vision benefits administrator, which fell victim to a cyberattack by the notorious data theft and extortion group ShinyHunters. In early June 2026, DentaQuest announced that it was investigating a cybersecurity incident involving a limited part of its computer network. The threat group had access to its network for around 3 days in May 2026.
ShinyHunters claimed responsibility and said 234 GB of data was exfiltrated in the incident, then started leaking the stolen data as it failed to reach an agreement with DentaQuest on a ransom payment. The leak included around 2. 6 million unique email addresses, and the breach was reported to OCR as affecting an estimated 15 million individuals.
That total may increase as the investigation progresses. The next three largest data breaches all occurred at business associates of HIPAA-covered entities. Aesto Health, a healthcare technology company that offers secure data migration, legacy data archiving, and electronic health record (EHR) exchanges, experienced a hacking incident that affected at least 39 of its healthcare clients and involved the protected health information of more than 9.
5 million individuals. The incident occurred in December 2025 and involved unauthorized access to its AWS environment. No threat group appears to have claimed responsibility.
Unlimited Technology Systems, an Ohio-based revenue cycle management and practice management software company, discovered its network had been accessed by an unauthorized third party for five days in October 2025, and potentially obtained the protected health information of more than 3. 8 million individuals. A similar-sized data breach was reported by CareCloud, a provider of cloud-based and AI-powered EHR, RCM, PM, and clinical documentation solutions, which discovered that a threat actor accessed its AWS environment over 6 days in March 2026, and likely exfiltrated databases containing the protected health information of more than 3.
7 million individuals. As with the incident at Unlimited Technology Systems, no threat group appears to have claimed responsibility. Regulated Entity State Covered Entity Type Individuals Affected Cause of Breach DentaQuest, LLC MA Health Plan 15,000,000 Hacking incident (ShinyHunters data theft and extortion group) Aesto, LLC AL Business Associate 9,540,683 Hacking incident Unlimited Technology Systems, LLC OH Business Associate 3,803,750 Hacking incident CareCloud, Inc.
NJ Business Associate 3,756,469 Hacking incident Lifespan Physician Group of Massachusetts, Inc. d/b/a Brown Health Medical Group-MA MA Healthcare Provider 311,760 Hacking incident One Medical Group, Inc. CA Healthcare Provider 153,174 Hacking incident (ShinyHunters data theft and extortion group) Madera Community Hospital CA Healthcare Provider 150,810 Hacking incident zHealth, Inc.
CA Business Associate 118,563 Ransomware attack (Kazu ransomware group) Boundary Regional Community Health Center dba Kaniksu Community Health ID Healthcare Provider 88,000 Hacking incident at business associate Aesto (see above) A-O-M-S, P. L. L.
C.
Originally published at hipaajournal.com
