Largest healthcare data breaches of 2026: the open cases on the HHS breach portal

The federal health breach list holds 415 reports submitted between January 5 and October 15, 2026 that are still under investigation. Together they count 77,717,790 people affected. The largest is DentaQuest's, at 15,000,000, followed by Aesto (9,540,683) and iRhythm Technologies (8,179,772). Fifteen reports count a million people or more, and the median report counts 5,385.

Key facts, from the Office for Civil Rights breach portal as downloaded on November 7, 2026:

• 415 open reports carry a 2026 submission date. Cases HHS has already closed move to a separate archive and are not counted here; the HIPAA Breach Notification Rule entry counts both lists together.
• 394 of the 415 (95%) are classed as a hacking or IT incident, and those account for 77,646,067 of the 77,717,790 people counted.
• Business associates (vendors that handle health data for providers and plans) filed 74 of the reports, but those count 31,213,072 people, or 40% of the total.
• The ten largest reports hold 56,099,710 people, 72% of everyone counted in 2026.
• Rechecked on November 12, the open list holds 412 reports from 2026; the newest large one is Central Ohio Primary Care Physicians, 1,351,650 people, submitted on October 16; the changes are set out below.
• Counting the portal's archive of resolved reports as well, HHS lists 637 reports from 2026 with 90,022,786 people (checked November 14). The archive's largest, Lumexa Imaging at 5,830,949, would rank fourth (see the archive section below).

Which open healthcare breach cases of 2026 affected the most people?

These are the 20 open reports submitted in 2026 with the most individuals affected. Names, states and dates are copied from the HHS list; the date is the day the report reached HHS, not the day of the breach, which the list does not show. Organizations with an entry in this log link to it.

Rank	Organization as HHS lists it	State	Type of filer	Submitted to HHS	Individuals affected
1	DentaQuest, LLC	MA	Health plan	Jul 16, 2026	15,000,000
2	Aesto, LLC	AL	Business associate	Jul 31, 2026	9,540,683
3	iRhythm Technologies, Inc.	CA	Healthcare provider	Oct 3, 2026	8,179,772
4	AdaptHealth, LLC	PA	Healthcare provider	Aug 14, 2026	4,115,802
5	Unlimited Technology Systems, LLC	OH	Business associate	Jul 21, 2026	3,803,750
6	CareCloud, Inc.	NJ	Business associate	Jul 24, 2026	3,756,469
7	TriZetto Provider Solutions	MO	Business associate	Feb 6, 2026	3,433,965
8	QualDerm Partners, LLC	TN	Healthcare provider	Feb 22, 2026	2,951,318
9	Baylor Genetics	TX	Healthcare provider	Aug 14, 2026	2,810,878
10	Nacogdoches Memorial Hospital	TX	Healthcare provider	Mar 30, 2026	2,507,073
11	Navia Benefit Solutions, Inc.	WA	Business associate	Mar 18, 2026	2,151,330
12	Insightin Health, Inc.	MD	Business associate	Jan 16, 2026	1,949,534
13	New York City Health and Hospitals Corporation	NY	Healthcare provider	Mar 24, 2026	1,800,000
14	Xsolis, Inc.	TN	Business associate	Jun 5, 2026	1,396,519
15	MCBS, LLC	GA	Business associate	Jun 26, 2026	1,261,464
16	Paradigm Healthcare Services	CA	Business associate	Sep 14, 2026	970,403
17	OpenLoop Health, Inc.	IA	Business associate	Mar 17, 2026	716,000
18	Erie Family Health Centers	IL	Healthcare provider	Mar 27, 2026	570,000
19	Centers Lab NJ LLC	NJ	Healthcare provider	Jun 18, 2026	542,377
20	Networking Technology, Inc.	NC	Business associate	May 29, 2026	353,844

All 20 are classed as a hacking or IT incident. All but one name a network server as the place the data was held; Navia's report names a network server and another location.

What changed on the HHS list since November 7?

Rechecked on November 12, 2026, the open list holds 412 reports with a 2026 submission date, three fewer than on November 7, and they count 77,492,165 people. HHS takes cases off the open list when it closes them, and new reports arrive as they are filed, so the list changes between downloads. The tables above keep the November 7 figures; the changes are below.

The newest large report is Central Ohio Primary Care Physicians, submitted on October 16, 2026 with 1,351,650 individuals affected, a hacking or IT incident on a network server. On the November 12 list it is the 14th-largest 2026 report. Call-on-Doc, Inc., a Texas healthcare provider, is now 18th with 648,535 individuals and a submission date of September 18, 2026; it was not in the November 7 top 20.

Four reports that were on the November 7 list are no longer on the open list: New York City Health and Hospitals Corporation (1,800,000), Southern Illinois Dermatology (160,312), Saint Anthony Hospital (146,108) and Wound Technology Network (139,830). Dropping off the open list does not make a breach smaller; it means the case is no longer listed as under investigation.

Four more entries in this log match reports on the November 12 list. Their ranks are among the 412 open 2026 reports on that date:

Entry	HHS report	Submitted	Individuals affected	Rank on Nov 12
Proxycare	Proxycare, Inc., healthcare provider, FL	Mar 27, 2026	45,196	81
Modoc Medical Center	Modoc Medical Center, healthcare provider, CA	Mar 27, 2026	29,688	99
Precipio	Precipio, Inc., healthcare provider, CT	Jan 23, 2026	22,739	112
Elara Caring	Elara Caring, healthcare provider, TX	Jun 23, 2026	22,172	113

All four are classed as hacking or IT incidents. Elara Caring's report names email as the place the information was; the other three name a network server, and Precipio's also names "other".

What does the HHS archive add for 2026?

Checked again on November 14, 2026, the open list holds 407 reports from 2026, which count 77,554,807 people. The portal's archive holds 230 more 2026 reports, counting 12,467,979 people. Both lists together give 637 reports from 2026 and 90,022,786 people. Seventeen count a million or more, and the median is 4,347. The archive is where HHS puts reports it has resolved. No 2026 report is 24 months old yet, so every archived 2026 report is a resolved one.

The archive's largest 2026 report is Lumexa Imaging's, at 5,830,949 people. Counted with the open cases, it would rank fourth for 2026, behind DentaQuest, Aesto and iRhythm. These are the ten largest 2026 reports in the archive:

Archived 2026 report	State	Entity type	Individuals affected	Submitted	Type of breach
Lumexa Imaging	NC	Healthcare Provider	5,830,949	May 15, 2026	Hacking/IT Incident
New York City Health and Hospitals Corporation	NY	Healthcare Provider	1,800,000	Mar 24, 2026	Hacking/IT Incident
Illinois Department of Human Services	IL	Health Plan	705,017	Jan 9, 2026	Unauthorized Access/Disclosure
ApolloMD Business Services, LLC	GA	Business Associate	626,540	Feb 10, 2026	Hacking/IT Incident
District of Columbia, Department of Health Care Finance	MD	Health Plan	399,086	Sep 3, 2026	Unauthorized Access/Disclosure
Minnesota Department of Human Services	MN	Health Plan	303,965	Jan 16, 2026	Unauthorized Access/Disclosure
Denver Health Medical Plan	CO	Health Plan	238,083	Oct 1, 2026	Hacking/IT Incident
Southern Illinois Dermatology	IL	Healthcare Provider	160,312	Apr 2, 2026	Hacking/IT Incident
Saint Anthony Hospital	IL	Healthcare Provider	146,108	Mar 6, 2026	Hacking/IT Incident
Vikor Scientific, LLC.	SC	Healthcare Provider	139,964	Feb 6, 2026	Hacking/IT Incident

Three of the four reports that left the open list between November 7 and 12 are on this table: New York City Health and Hospitals Corporation, Southern Illinois Dermatology and Saint Anthony Hospital. The fourth, Wound Technology Network (139,830), is in the archive too, just below the top ten. The ranks elsewhere on this page are among open cases only. The 2025 ranking counts both lists for 2025.

How many healthcare breach reports reach HHS, and how big are they?

Measure	2026 reports on the open list
Reports	415
Individuals affected (sum of reports)	77,717,790
Median per report	5,385
Reports of 1,000,000 or more	15
Reports of 100,000 or more	47
Smallest report	500

The list only takes breaches of 500 or more people, which is why the smallest report counts exactly 500. One person can be counted in several reports, and a vendor's breach can show up both in the vendor's own report and in its clients' reports, so the sum counts notices, not different people.

Reports submitted by month:

Month submitted	Reports
January	25
February	36
March	48
April	33
May	50
June	50
July	67
August	42
September	47
October (to the 15th)	17

July had the most reports of any month in 2026, 67.

Who files the reports: providers, health plans or business associates?

Type of filer	Reports	Individuals affected	Median per report
Healthcare provider	320	31,165,868	5,349.5
Business associate	74	31,213,072	6,596.5
Health plan	21	15,338,850	4,055

Providers file most of the reports (320 of 415, 77%), but business associates' 74 reports count slightly more people. Eleven of the 20 largest reports in 2026 came from business associates: billing, software, benefits and record-handling firms such as CareCloud, TriZetto Provider Solutions, Navia Benefit Solutions and Xsolis. The list also marks whether a business associate was involved; 88 of the 2026 reports say one was, including 14 filed by a provider or plan.

A business associate that finds a breach has to tell the covered entity it works for, without unreasonable delay and no later than 60 days after discovery. That is why patients often get a letter from a clinic or a health plan about a company they never dealt with; the guide to letters from unfamiliar companies explains the chain.

How did the 2026 healthcare breaches happen?

Type of breach	Reports	Individuals affected
Hacking/IT incident	394	77,646,067
Unauthorized access/disclosure	18	53,974
Theft	2	1,204
Improper disposal	1	16,545

Where the information was (a report can name several)	Reports
Network server	319
Email	86
Other	21
Electronic medical record	14
Desktop computer	8
Laptop	3
Paper/films	3

Network servers appear in 319 reports (77%) and email in 86 (21%); 81 reports name email alone. Laptops appear in 3 reports and paper or films in 3.

Which states file the most healthcare breach reports?

The state on the list is the filer's state, not where its patients live. Texas leads with 43 reports in 2026, then California (30), Florida (29), New York (25), Pennsylvania (18) and Illinois (16). By people affected, Massachusetts leads (15,587,627) because DentaQuest's report lists Massachusetts, followed by California (9,899,841) and Alabama (9,628,773), the state on Aesto's report.

Do HHS and the states count the same breach the same way?

Not always. Indiana's attorney general publishes a total for each notice it receives, so the two lists can be set side by side. Eight of the 20 largest HHS reports of 2026 have a matching row in Indiana's 2026 report:

Organization	HHS individuals affected	Indiana's total affected	Indiana residents
DentaQuest	15,000,000	29,000,000	139,500
Aesto (Indiana lists the client, Grant Co Public Hospital District #2 dba Quincy Valley Med Ctr)	9,540,683	9,540,683	13
Unlimited Technology Systems	3,803,750	3,836,316	28,384
TriZetto Provider Solutions	3,433,965	3,433,965	7,155
Baylor Genetics	2,810,878	986	12
Nacogdoches Memorial Hospital	2,507,073	257,073	57
Navia Benefit Solutions	2,151,330	Not given	6,088
Xsolis	1,396,519	2,523,302	2,920

Of the seven with a total on both lists, only two agree exactly. The gaps run both ways: Indiana's DentaQuest total is almost twice the HHS figure, while its Baylor Genetics total is 986 against 2,810,878 at HHS. Neither list says why. An organization can report a first estimate to one regulator and a revised count to another, file separately for different client groups, or make an entry error. The Nacogdoches figures differ only by one digit (2,507,073 and 257,073). Where a breach matters to you, the letter you received and the organization's own filings are the better guide; the log entries linked on this page compare them where they can.

Which healthcare breaches ranked 21st to 65th in 2026?

Below the top 20, the next 45 open reports from 2026 run from 327,754 people down to 67,115. Most come from single providers: physician practices, clinics, labs and hospitals. A few come from business associates, among them a law firm and a management company. 27 of the 45 have an entry in this log, each built from the organization's own letter or filing and the regulators' records, and the table links to them.

Rank	Organization as HHS lists it	State	Type of filer	Submitted to HHS	Individuals affected
21	American Addiction Centers	TN	Business associate	Aug 7, 2026	327,754
22	Lifespan Physician Group of Massachusetts, Inc. d/b/a Brown Health Medical Group-MA	MA	Healthcare provider	Jul 16, 2026	311,760
23	North Texas Behavioral Health Authority	TX	Healthcare provider	Mar 6, 2026	285,086
24	Saber Healthcare Group	OH	Business associate	Sep 25, 2026	282,727
25	Premier Medical Group of the Hudson Valley P.C.	NY	Healthcare provider	Aug 21, 2026	282,075
26	Florida Physician Specialists	FL	Healthcare provider	Apr 24, 2026	276,498
27	Radiology Associates of Richmond	VA	Healthcare provider	May 21, 2026	266,183
28	Ridgeway Pharmacy, Ltd	MT	Healthcare provider	Sep 21, 2026	258,920
29	Boston Healthcare for the Homeless Program	MA	Healthcare provider	Aug 10, 2026	201,260
30	Tarter Krinsky & Drogin LLP	NY	Business associate	Sep 15, 2026	196,645
31	Atlantic Digestive Specialists, PLLC	NH	Healthcare provider	Sep 30, 2026	173,853
32	Anatomic and Clinical Laboratory Associates, P.C.	TN	Healthcare provider	Jun 23, 2026	169,626
33	Lake Region Healthcare	MN	Healthcare provider	Jul 1, 2026	167,617
34	Southern Illinois Dermatology	IL	Healthcare provider	Apr 2, 2026	160,312
35	One Medical Group, Inc.	CA	Healthcare provider	Jul 17, 2026	153,174
36	Madera Community Hospital	CA	Healthcare provider	Jul 13, 2026	150,810
37	Saint Anthony Hospital	IL	Healthcare provider	Mar 6, 2026	146,108
38	Operation PAR, Inc.	FL	Business associate	Jun 25, 2026	145,714
39	Laurel Eye Clinic	PA	Healthcare provider	Apr 22, 2026	145,221
40	Innovative Scientific Solutions, LLC	SC	Healthcare provider	Apr 17, 2026	143,842
41	Wound Technology Network, Inc.	FL	Healthcare provider	Jan 28, 2026	139,830
42	Clover Health	MN	Health plan	Sep 14, 2026	138,677
43	IPPC Inc., IPPC of New York LLC, and Innovative Pharmacy LLC (collectively “IPPC”)	NJ	Healthcare provider	Feb 27, 2026	133,862
44	AngMar Management Services	TX	Business associate	Sep 16, 2026	126,196
45	zHealth, Inc.	CA	Business associate	Jul 29, 2026	118,563
46	Western Orthopaedics, P.C.	CO	Healthcare provider	May 1, 2026	113,330
47	Coastal Carolina Health Care, PA	NC	Healthcare provider	Mar 24, 2026	110,304
48	Oakdale Ear Nose & Throat PA d/b/a Minnesota ENT	MN	Healthcare provider	Aug 12, 2026	99,714
49	Hospital Caribbean Medical Center	not given	Healthcare provider	Apr 6, 2026	92,000
50	Chicago Family Health Center	IL	Healthcare provider	Jun 22, 2026	90,000
51	Stockton Cardiology Medical Group	CA	Healthcare provider	Mar 18, 2026	90,000
52	National Association on Drug Abuse Problems	NY	Healthcare provider	Feb 13, 2026	90,000
53	Mid Florida Dermatology & Plastic Surgery	FL	Healthcare provider	May 1, 2026	85,585
54	Counseling Center of Wayne & Holmes Counties	OH	Healthcare provider	Feb 9, 2026	83,354
55	Aitkin County Health and Human Services	MN	Business associate	Jun 17, 2026	83,114
56	Clinic Service Corporation	CO	Business associate	Jan 28, 2026	82,331
57	Minnesota Epilepsy Group, P.A.	MN	Healthcare provider	Jun 5, 2026	80,061
58	Gay & Lesbian Community Services Center of Orange County, Inc.	CA	Healthcare provider	Jun 5, 2026	75,532
59	Ultramobile Imaging	NY	Healthcare provider	Sep 25, 2026	75,000
60	ERMI LLC	GA	Healthcare provider	May 26, 2026	74,074
61	Academic Urology & Urogynecology of Arizona	AZ	Healthcare provider	Feb 13, 2026	73,281
62	Osceola Mental Health Inc. dba Park Place Behavioral Healthcare	FL	Healthcare provider	Aug 26, 2026	71,702
63	Colorado Health Network Inc.	CO	Healthcare provider	Jun 19, 2026	68,212
64	Texas Health and Human Services Commission	TX	Health plan	Jan 5, 2026	68,066
65	Tri-Cities Gastroenterology	TN	Healthcare provider	Apr 29, 2026	67,115

The 45 reports in this band add up to 6,575,088 people.

Which organizations appear more than once on the HHS list?

Of the 746 open reports, 14 organization names appear more than once. Some pairs are months apart; others were filed on the same day. The HHS list does not say whether reports under one name concern the same incident. Where this log has an entry, the name links to it.

Organization as HHS lists it	Reports	Dates submitted and individuals affected
Radiology Associates of Richmond, Inc.	2	Jul 1, 2025: 1,419,091; May 21, 2026: 266,183
Fieldtex Products, Inc.	5	Nov 20, 2025: 238,615; Dec 3, 2025: 5,901; Dec 3, 2025: 9,206; Dec 3, 2025: 20,641; Dec 12, 2025: 104,071
Harbor	2	Jun 20, 2025: 2,703; Sep 30, 2025: 216,000
Saint Anthony Hospital	2	Sep 12, 2025: 6,679; Mar 6, 2026: 146,108
Minnesota Epilepsy Group	2	Apr 28, 2025: 38,401; Jun 5, 2026: 80,061
WindRose Health Network	2	Jan 27, 2026: 9,087; Sep 16, 2026: 33,158
Community Connections	2	Dec 11, 2024: 18,949; May 18, 2026: 18,943
Gastro Health	2	May 22, 2026: 1,628; May 22, 2026: 35,632
Trinity Health	2	Mar 13, 2026: 2,740; Sep 30, 2026: 33,234
Texas Center for Infectious Disease Associates	2	Jun 30, 2025: 19,481; Sep 10, 2025: 1,236
AltaMed Health Services Corporation	2	Jun 13, 2025: 4,530; Feb 26, 2026: 501
Option Care Health, Inc.	2	Feb 20, 2026: 2,086; Apr 6, 2026: 1,891
McEwen & Associates	3	Aug 21, 2025: 500; Aug 21, 2025: 500; Aug 21, 2025: 500
Capitol Pain Institute	2	May 1, 2026: 695; Oct 13, 2026: 666

Which of these breaches are in this log?

Of the top 20, 18 have an entry here; the exceptions are New York City Health and Hospitals Corporation and Centers Lab NJ, for which this log has not found a letter filed with a state. Below the top 65, the log also covers several smaller 2026 reports from the HHS list:

Entry	HHS report	Individuals affected	Rank among open 2026 cases
Photon Health	Photon Health, business associate, Oct 9, 2026	30,625	97
Indico Data Solutions	Indico Data Solutions, Inc., business associate, Aug 7, 2026	4,840	217
NCH Corporation	NCH Corporation Employee Benefits Plan, health plan, May 1, 2026	4,055	231
Alma Family Services	Alma Family Services, healthcare provider, Sep 10, 2026	2,753	255
Quantum Health	Quantum Health, business associate, Jul 29, 2026	2,104	272

The same breach can carry very different numbers on different lists. DentaQuest's report counts 15,000,000 people at HHS, while the Washington ranking shows 153,300 Washingtonians for it, because a state list counts only its own residents. For a ranking across all sectors from Indiana's report, see the largest data breaches of 2026 by people affected.

Why is a 2026 breach missing from the HHS list?

There are three common reasons. The list only shows breaches of 500 or more people. It only shows cases still under investigation: the portal describes the page as listing all HIPAA breaches reported within the last 24 months that are currently under investigation, and closed cases move to an archive. And the list is updated in batches. On November 7, 2026 its newest report was dated October 15, 2026, so breaches reported since then, such as Hoag Memorial Hospital Presbyterian's, are not on it yet.

How this was counted

The figures come from the CSV export of the cases-under-investigation page of the Office for Civil Rights breach portal, downloaded on November 7, 2026 (746 reports in all, the newest dated October 15, 2026). A report counts as 2026 when its breach submission date falls in 2026. Ranks use the individuals-affected figure as HHS lists it. The table of where the information was counts each location a report names, so those rows add up to more than 415. Percentages and medians are this site's arithmetic, rounded to whole numbers. Reports already closed and moved to the archive are not counted, so this is a floor for 2026, not a full count. The 2025 ranking counts both lists, the open cases and the archive. Indiana figures come from its 2026 year-to-date report, downloaded the same day and read row by row; a row matches when the organization and the timing line up. Names are copied as listed, with stray trailing characters removed (HHS lists the Nacogdoches report as "Nacogdoches Memorial Hospital n").

What is the largest healthcare data breach of 2026?

Among the open cases on the HHS list it is DentaQuest's: a hacking or IT incident on a network server, submitted on July 16, 2026, with 15,000,000 individuals affected. Aesto (9,540,683) and iRhythm Technologies (8,179,772) follow.

How many people were affected by healthcare data breaches in 2026?

The 415 open reports submitted in 2026 add up to 77,717,790 individuals as of the October 15 submission date. Closed 2026 cases in the archive add to that, so the full figure is higher. Because one person can be counted in several reports, the number of different people is lower and HHS does not publish it.

What is the HHS breach portal?

It is the public list that the Department of Health and Human Services keeps under the HITECH Act. The portal says that, as section 13402(e)(4) of the HITECH Act requires, the Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals. Each row gives the organization, its state, the type of filer, the number of individuals affected, the submission date, the type of breach and where the information was held. The HIPAA Breach Notification Rule entry explains what counts as a breach.

When does a healthcare organization have to report a breach to HHS?

For a breach of 500 or more people, a covered entity must notify HHS at the same time as it notifies the individuals. Individuals must be told without unreasonable delay and no later than 60 calendar days after the breach is discovered. Smaller breaches are logged and reported to HHS within 60 days after the end of the calendar year in which they were discovered.

How can I tell if my health data was in one of these breaches?

The HHS list does not name individuals. The organization that held your data sends the letter, and it is often a clinic, insurer or plan rather than the vendor that was breached. The healthcare provider breach notices guide shows what such letters say and what they offer.