July 2026 US healthcare breaches: 77 incidents, 33.5M people exposed, led by ShinyHunters' DentaQuest attack
In July 2026, 77 large healthcare data breaches (500+ individuals) were reported to the HHS Office for Civil Rights (OCR), a 10% month-over-month increase and the third consecutive monthly rise. At least 33,485,970 individuals were affected, up 642% from June and 154% above the 12-month average. January-July 2026 totals 67.4 million affected individuals, up 35.1% year-over-year, with breach counts level with the same period in 2025. The four largest incidents affected more than 32 million people, and three of them occurred at business associates.
Detalhes técnicos
- DentaQuest (a Sun Life U.S. dental and vision benefits administrator): the largest incident, reported as affecting about 15 million individuals, the 4th largest healthcare breach ever reported by a single HIPAA-regulated entity. ShinyHunters had network access for about 3 days in May 2026 and claimed 234 GB exfiltrated. It leaked the data, including about 2.6 million unique email addresses, after ransom talks failed.
- Aesto Health: unauthorized access to its AWS environment in December 2025 affected at least 39 healthcare clients and more than 9.5 million individuals. No group claimed it.
- Unlimited Technology Systems: an unauthorized third party had network access for five days in October 2025, potentially exposing more than 3.8 million individuals. No group claimed it.
- CareCloud: a threat actor accessed its AWS environment over 6 days in March 2026 and likely exfiltrated databases covering more than 3.7 million individuals. No group claimed it.
- Hacking/IT incidents accounted for 87% of July breaches and 99.9% of affected individuals. Network servers were the most common location of breached PHI, followed by email systems.
- Texas had the most breaches (11), followed by California (9). Massachusetts had the most affected individuals (more than 18 million).
- OCR announced one enforcement action, a $552,250 settlement with OSF Healthcare System over a 2021 ransomware attack affecting 53,907 individuals. The failures cited were no compliant risk analysis, impermissible disclosure and late breach notifications.
Remediação
The article does not give technical remediation guidance. It notes that OCR is scrutinizing risk analysis and Breach Notification Rule compliance, with eight settlements since the start of 2025 including notification-failure penalties. Covered entities remain responsible for notifications even when a business associate is breached.
Linha do tempo
-
July 2026 US healthcare breaches: 77 incidents, 33.5M people exposed, led by ShinyHunters' DentaQuest attack
ler a análise desta fonte ocultar
In July 2026, 77 large healthcare data breaches (500+ individuals) were reported to the HHS Office for Civil Rights (OCR), a 10% month-over-month increase and the third consecutive monthly rise. At least 33,485,970 individuals were affected, up 642% from June and 154% above the 12-month average. January-July 2026 totals 67.4 million affected individuals, up 35.1% year-over-year, with breach counts level with the same period in 2025. The four largest incidents affected more than 32 million people, and three of them occurred at business associates.
Technical Details
- DentaQuest (a Sun Life U.S. dental and vision benefits administrator): the largest incident, reported as affecting about 15 million individuals, the 4th largest healthcare breach ever reported by a single HIPAA-regulated entity. ShinyHunters had network access for about 3 days in May 2026 and claimed 234 GB exfiltrated. It leaked the data, including about 2.6 million unique email addresses, after ransom talks failed.
- Aesto Health: unauthorized access to its AWS environment in December 2025 affected at least 39 healthcare clients and more than 9.5 million individuals. No group claimed it.
- Unlimited Technology Systems: an unauthorized third party had network access for five days in October 2025, potentially exposing more than 3.8 million individuals. No group claimed it.
- CareCloud: a threat actor accessed its AWS environment over 6 days in March 2026 and likely exfiltrated databases covering more than 3.7 million individuals. No group claimed it.
- Hacking/IT incidents accounted for 87% of July breaches and 99.9% of affected individuals. Network servers were the most common location of breached PHI, followed by email systems.
- Texas had the most breaches (11), followed by California (9). Massachusetts had the most affected individuals (more than 18 million).
- OCR announced one enforcement action, a $552,250 settlement with OSF Healthcare System over a 2021 ransomware attack affecting 53,907 individuals. The failures cited were no compliant risk analysis, impermissible disclosure and late breach notifications.
Remediation
The article does not give technical remediation guidance. It notes that OCR is scrutinizing risk analysis and Breach Notification Rule compliance, with eight settlements since the start of 2025 including notification-failure penalties. Covered entities remain responsible for notifications even when a business associate is breached.