Largest healthcare data breaches of 2025: every report on the HHS breach portal

The federal breach portal lists 811 healthcare data breaches submitted to HHS in 2025, each affecting 500 or more people, and 141,810,443 people affected in all. The largest is Conduent Business Services' report of 62,224,658 people, filed as a business associate. 16 reports each count more than a million people.

Key facts, from the portal's two lists as downloaded on November 14, 2026:

• 811 reports carry a 2025 submission date. 289 are still on the list of cases under investigation, and 522 have moved to the archive.
• The 16 reports of a million or more people hold 112,507,139 of the 141,810,443 people, 79% of the year. Conduent's alone is 44%.
• Half of the 2025 reports count 4,943 people or fewer.
• Hacking or IT incidents account for 656 reports (81%) and 135,611,385 people (95.6%).
• Business associates filed 141 reports (17%), and those reports cover 88,431,564 people (62.4%).
• The counts are people per report. Someone in several breaches is counted in each, so the total is not the number of different people.

Which healthcare data breaches of 2025 affected the most people?

These are the 25 reports submitted in 2025 with the most people affected, from either list. Names are copied as HHS lists them, without stray spaces. "List" shows whether the report is still under investigation or has been archived. Organizations with an entry in this log link to it.

Rank	Organization as HHS lists it	State	Entity type	People affected	Submitted	Breach type	List
1	Conduent Business Services LLC	NJ	Business Associate	62,224,658	Oct 8, 2025	Hacking/IT Incident	Open
2	Aflac Incorporated (“Aflac”)	GA	Health Plan	13,924,906	Aug 8, 2025	Hacking/IT Incident	Open
3	Episource, LLC	CA	Business Associate	6,725,572	Jun 6, 2025	Hacking/IT Incident	Open
4	Yale New Haven Health System	CT	Healthcare Provider	5,556,702	Apr 11, 2025	Hacking/IT Incident	Archive
5	Blue Shield of California	CA	Business Associate	4,700,000	Apr 9, 2025	Unauthorized Access/Disclosure	Archive
6	PIH Health, Inc.	CA	Healthcare Provider	2,947,264	Jan 31, 2025	Hacking/IT Incident	Open
7	DaVita Inc.	CO	Healthcare Provider	2,689,826	Aug 1, 2025	Hacking/IT Incident	Open
8	Veradigm LLC	IL	Business Associate	2,672,036	Sep 22, 2025	Hacking/IT Incident	Open
9	Anne Arundel Dermatology	MD	Healthcare Provider	1,905,000	Jul 11, 2025	Hacking/IT Incident	Open
10	Kettering Adventist Healthcare	OH	Healthcare Provider	1,695,382	Jul 21, 2025	Hacking/IT Incident	Open
11	Radiology Associates of Richmond, Inc.	VA	Healthcare Provider	1,419,091	Jul 1, 2025	Hacking/IT Incident	Open
12	DermCare Management	FL	Business Associate	1,361,735	May 2, 2025	Hacking/IT Incident	Archive
13	SimonMed Imaging	AZ	Healthcare Provider	1,275,669	Mar 27, 2025	Hacking/IT Incident	Archive
14	Absolute Dental Group, LLC	NV	Business Associate	1,223,635	May 2, 2025	Hacking/IT Incident	Open
15	Southeast Series of Lockton Companies, LLC (Lockton)	GA	Business Associate	1,124,727	Feb 28, 2025	Hacking/IT Incident	Open
16	Community Health Center, Inc.	CT	Healthcare Provider	1,060,936	Jan 30, 2025	Hacking/IT Incident	Archive
17	Frederick Health	MD	Healthcare Provider	934,326	Mar 28, 2025	Hacking/IT Incident	Archive
18	McLaren Health Care	MI	Healthcare Provider	743,131	Jun 24, 2025	Hacking/IT Incident	Open
19	Medusind Inc.	FL	Business Associate	701,475	Jan 7, 2025	Hacking/IT Incident	Open
20	Blue & Co., LLC	IN	Business Associate	591,713	Feb 7, 2025	Hacking/IT Incident	Archive
21	Washington Gastroenterology	WA	Healthcare Provider	583,471	May 9, 2025	Hacking/IT Incident	Archive
22	Kelly & Associates Insurance Group, Inc.	MD	Business Associate	553,332	Apr 9, 2025	Hacking/IT Incident	Open
23	United Seating and Mobility, LLC d/b/a Numotion	TN	Healthcare Provider	529,004	Mar 7, 2025	Hacking/IT Incident	Archive
24	Serviceaide, Inc.	CA	Business Associate	483,126	May 9, 2025	Unauthorized Access/Disclosure	Archive
25	Wakefield & Associates, LLC	TN	Business Associate	464,946	Nov 7, 2025	Hacking/IT Incident	Open

Conduent, Episource and Veradigm also carry state attorney general counts on their entries in this log. The 2025 ranking from Indiana's report covers every sector. Its two largest, Prosper Marketplace and TransUnion, do not appear on the HHS list.

How many healthcare breaches were reported to HHS in 2025, and how big were they?

811 reports, about 68 a month. The portal only lists breaches of 500 or more people. Smaller ones go to HHS in a yearly log and are not published.

People affected	2025 reports
500 to 999	137
1,000 to 9,999	349
10,000 to 99,999	227
100,000 to 999,999	82
1,000,000 or more	16

The rule sets those two routes. A covered entity reports a breach of 500 or more people to HHS at the same time as it notifies the people affected. A smaller breach goes in a log, which the covered entity sends to HHS within 60 days after the end of the year. The HIPAA Breach Notification Rule explains what counts as a breach.

Who reported: providers, health plans or business associates?

Entity type	Reports	Share of reports	People affected	Share of people
Healthcare provider	608	75%	37,879,848	26.7%
Business associate	141	17%	88,431,564	62.4%
Health plan	60	7%	15,285,524	10.8%
Healthcare clearinghouse	2	0.2%	213,507	0.2%

Providers file most of the reports. Business associates file far fewer, and their typical report is only a little larger: the median is 5,901 people, against 4,877 for providers and 3,758 for health plans. The difference is at the top. Business associates in the top 25 include Conduent, Episource, Veradigm, DermCare Management, Lockton and Medusind, and Conduent's report alone is larger than all 608 provider reports combined. A further set of reports is filed by the provider or plan but marks a business associate as involved: 285 of the 811 reports say a business associate was present, and they cover 90,616,191 people. The business associate entry explains the vendor's duty to tell its client.

How did the 2025 healthcare breaches happen?

Type of breach	Reports	People affected
Hacking/IT incident	656	135,611,385
Unauthorized access/disclosure	143	6,115,958
Theft	9	44,417
Loss	2	4,008
Improper disposal	1	34,675

The portal gives one broad type per report and does not say how the intruder got in. For that, read the organization's own letter, which this log's entries quote. Two of the top 25, Blue Shield of California and Serviceaide, are filed as unauthorized access or disclosure rather than hacking.

Where the information was, as each report lists it (a report can name more than one place): network server 516, email 197, paper or films 42, electronic medical record 35, other 19, laptop 13, desktop computer 11, other portable device 6.

Which states reported the most?

By the state of the organization that filed: California 76 reports (16,568,173 people), Texas 57 (1,599,172), Florida 55 (5,065,503), New York 46 (1,105,818), Ohio 40 (2,300,859), Pennsylvania 37 (1,292,990), Illinois 29 (3,318,908), Michigan 27 (1,817,111), Tennessee 26 (1,377,296) and Georgia 25 (15,628,846). Georgia's total is mostly Aflac's report. The state is where the organization is, not where the patients live. The state attorney general rankings count residents instead: Texas, Washington and Massachusetts.

How does 2025 compare with 2024 and 2026?

2025 had more reports than 2024 but far fewer people. The portal lists 741 reports submitted in 2024, covering 290,839,712 people. One of them, Change Healthcare's, counts 192,700,000. Without it, 2024's reports count fewer people than 2025's. For 2026, the portal lists 637 reports so far (the newest submitted October 16, 2026), covering 90,022,786 people. The 2026 ranking covers the open 2026 cases.

Why are most 2025 reports in the archive?

Because they are closed. The portal keeps two lists. The open one shows breaches reported within the last 24 months that the Office for Civil Rights is still investigating. The archive holds every resolved report, plus every report older than 24 months. A 2025 report is not yet 24 months old, so the 522 in the archive are reports HHS has already resolved. A count from the open list alone would miss them, including 10 of the 25 largest.

How this was counted

The figures come from the CSV exports of both lists on the Office for Civil Rights breach portal, downloaded on November 14, 2026. There are 718 reports under investigation, the newest dated October 16, 2026, and 7,374 in the archive. A report counts as 2025 when its breach submission date falls in 2025. Ranks use the individuals-affected figure as HHS lists it. Reports are counted as listed: McEwen & Associates appears three times with the same date and count, and Sturgis Hospital twice, and each listing is counted. The table of places counts each location a report names. Percentages are this site's arithmetic. A link to an entry means the entry cites the same report, matched on the organization and the count.

What was the largest healthcare data breach of 2025?

Conduent Business Services' report of 62,224,658 people, submitted on October 8, 2025, is the largest of the year on the HHS portal. Next are Aflac's, at 13,924,906, and Episource's, at 6,725,572.

How many people were affected by healthcare data breaches in 2025?

The 811 reports add up to 141,810,443 people. A person affected by several breaches is counted once in each, so the number of different people is lower and is not published.

Is the HHS list complete for 2025?

For breaches of 500 or more people, the two lists together hold what was reported. Breaches under 500 people are reported in yearly logs that the portal does not show.

How can I tell if my health data was in one of these breaches?

The letter is the best evidence. The portal lists organizations and counts, not people. If a letter came from a company you never dealt with, it may be a vendor of your provider or plan (why that happens).