Real privacy violations.
Real consequences.

EpiSource — a medical-coding subsidiary in the UnitedHealth Group portfolio — disclosed in 2025 that a ransomware group had access to its network from January 27 through February 6, 2025. The attacker accessed files containing names, addresses, dates of birth, Social Security numbers, member IDs, and diagnosis and treatment details for approximately 5,418,866 individuals. Notification letters began in mid-2025; the OCR Breach Portal listing remains in active investigation. The breach lands inside the same parent organization as the 2024 Change Healthcare incident, intensifying scrutiny of UHG vendor security posture across the federation.

In April 2025, ransomware actors accessed a DaVita laboratory database containing protected health information of 2,689,826 individuals. DaVita operates more than 2,600 dialysis centers across the United States; the exposed data included names, addresses, dates of birth, Social Security numbers, medical record numbers, and treatment and laboratory information specific to chronic kidney disease care. Operations were temporarily disrupted; notification began in June 2025. The breach is notable for the specificity of the exposed clinical data — kidney-disease patients carry a particularly stigmatized and commercially valuable health profile in the data-broker market.

Newport Harbor Pathology Medical Group — a Newport Beach, California pathology practice also operating as Orange County Medical Group Pathology, Mission Laguna Pathology Medical Group, and Barr Dermatopathology — detected unauthorized access to its network on November 11, 2024. A forensic investigation confirmed the attacker had access from October 8 through November 11, 2024. Exposed data included names, dates of birth, addresses, Social Security numbers, driver's license numbers, health insurance information, diagnoses, and pathology test results. The breach was reported to OCR on January 10, 2025, with an interim count of 501 individuals. The case is the highest-volume Newport Beach healthcare breach search-traffic driver in 2025–2026 and highlights how small-volume incidents at pathology and specialty practices can carry disproportionate identity-theft risk because of the combination of SSN + diagnosis exposure. <a href="/breaches/newport-harbor-pathology-2025" class="text-primary underline">Full breakdown →</a>

ALPHV/BlackCat ransomware operators accessed ~6TB of data via a Citrix portal that lacked multi-factor authentication, exfiltrating medical records, SSNs, insurance details, and active-duty military data. A $22 million ransom was paid; the gang executed an exit scam and kept the funds without deleting the data. CEO Andrew Witty testified to Congress that MFA was not enabled on the breached server. OCR investigation and a 78-case class-action MDL in the District of Minnesota remain ongoing.

Kaiser disclosed in October 2023 that tracking technologies on its websites and mobile apps had been transmitting member IP addresses, sign-in status, navigation patterns, and health-encyclopedia searches (symptoms, drugs, exercises) to third-party ad platforms. The disclosure was reported to OCR in May 2024 affecting up to 13.4 million members across nine states and DC — the largest confirmed pixel-tracking PHI disclosure in healthcare history. The class settlement covers members who used authenticated pages between November 2017 and May 2024.

Beginning February 2014, attackers gained entry via phishing emails and maintained network access for nearly a year before a database administrator noticed credential misuse in January 2015. Exposed data included names, SSNs, birth dates, addresses, employment data, and health IDs. Anthem's $16M HHS settlement remains the largest HIPAA enforcement action on record; the case is the comparative anchor for every health-plan breach since.

In May 2024 an Ascension employee downloaded a malicious file believed to be legitimate, giving Black Basta operators a foothold for enterprise-wide lateral movement. Nurses reverted to paper charting for weeks, ambulances were diverted, and attackers exfiltrated names, SSNs, medical records, insurance details, payment data, and government IDs. The final affected count of 5,599,699 individuals was reported to OCR in December 2024.

YNHHS identified suspicious activity on March 8, 2025, and reported the breach to OCR on April 11 affecting 5,556,702 individuals. While the EMR itself was not accessed, attackers exfiltrated names, addresses, phone, email, DOB, race/ethnicity, patient type, medical record numbers, and Social Security numbers. The consolidated class action settled in roughly seven months — class members can claim up to $5,000 for documented losses, ~$100 alternative cash payments, plus two years of medical-data monitoring.

Disclosed October 2023, attackers reused passwords leaked from other breaches to access roughly 14,000 23andMe accounts directly, then leveraged the DNA Relatives feature to expose data on 6.4 million users. Stolen data was offered for sale targeting Ashkenazi Jewish and Chinese populations. 23andMe filed Chapter 11 in March 2025; assets sold to nonprofit TTAM Research Institute (led by co-founder Anne Wojcicki) for $305M in July 2025. The class settlement provides up to $10,000 per documented loss, $165 to health-data-affected users, and five years of identity-theft and genetic-anomaly monitoring.

Disclosed April 9, 2025, Blue Shield reported that between April 2021 and January 2024 a Google Analytics configuration allowed member data to flow into Google Ads for ad targeting. Exposed fields included names, family size, plan details, city and zip, account identifiers, medical claims details, patient financial responsibility, and doctor-search activity. The data flow was severed in January 2024 — but the issue was not internally identified until February 11, 2025, more than a year later.

A spear-phishing campaign gave attackers persistent network access from May 2014 through March 2015. The intrusion was discovered January 2015 and disclosed publicly that March. Exposed data included names, DOBs, SSNs, member IDs, addresses, phone numbers, email addresses, bank-account information, and claims data. OCR's $6.85M settlement in September 2020 remains the second-largest HIPAA enforcement action; the parallel class action settled for approximately $74M.

In April 2024 the FTC announced enforcement against telehealth mental-health provider Cerebral for sharing patient information — including details about ADHD treatment, anxiety, and depression — to social platforms through pixels and SDKs while misrepresenting privacy practices and frustrating subscription cancellation. The proposed order permanently bans Cerebral from using or disclosing personal and health information for most marketing without affirmative consent. As of May 2025, more than $5M in refunds had been distributed to over 40,000 consumers.

From April 2011 through April 2012, login credentials of a former employee at an affiliated physician's office were used daily to access ePHI maintained by Memorial Healthcare System — without detection. Two additional incidents in 2012 revealed inappropriate access by 12 users at affiliated physician offices. OCR found that MHS failed to regularly review audit logs, access reports, and security-incident tracking reports — a textbook violation of the HIPAA Security Rule's audit-controls requirement.

NewYork-Presbyterian allowed ABC's 'NY Med' film crew nearly unrestricted access to its facilities, including filming a patient dying in the emergency room (Mark Chanko, struck by a sanitation truck in 2011) and another in acute distress, without prior patient or family authorization. OCR called it an "egregious disclosure" and emphasized that media access to PHI requires affirmative written authorization — there is no public-interest or newsworthiness exception under HIPAA.

Between 2005 and 2009, multiple UCLA Health employees were terminated for snooping on the medical records of high-profile patients. Former administrative specialist Lawanda Jackson pleaded guilty to selling celebrity record details to the National Enquirer; former researcher Huping Zhou was sentenced to four months in federal prison — the first individual criminally convicted under HIPAA. UCLA settled with OCR in July 2011 for $865,000 with an extensive corrective-action plan.