Healthcare breaches: Cognitive Health Technologies (49,467), City Ambulance Service (Qilin), Baraga County Memorial Hospital (Wallstreet) and two others
Five US healthcare organizations have disclosed data security incidents. The largest is Cognitive Health Technologies LLC (New York), where an unauthorized party had network access between February 5 and April 28, 2026 and acquired files with PHI of 49,467 individuals. The Qilin group claimed the attack on Viking Enterprises (City Ambulance Service) in Texas (14,324 individuals, 14 GB claimed), and Wallstreet ransomware claimed Baraga County Memorial Hospital in Michigan. Innovative Alternatives (Texas, about 1,500 people) suffered a ransomware attack, and The Speech Clinic (Georgia) had a computer and an old server with records of 2,168 patients remotely accessed.
Detalhes técnicos
- Cognitive Health Technologies: suspicious activity detected April 27, 2026; exposed names, dates of birth, health insurance information, medical histories and treatment information. No misuse identified.
- City Ambulance Service: reported to OCR on August 31, 2026 as an email-related hacking incident. Exposed names, addresses, dates of birth, medical and health insurance information, and Social Security numbers (per the Texas AG filing). Qilin's leak site listing dated July 19, 2026 claims 14 GB exfiltrated and published; the HIPAA Journal could not verify the claim, though proof screenshots include patient data. It is unclear whether ransomware was deployed.
- Baraga County Memorial Hospital: reported to OCR as a hacking/IT incident with a placeholder of 501+ individuals. Wallstreet listed the hospital on July 4, 2026 and leaked the data after the ransom was not paid.
- Innovative Alternatives: discovered August 2, 2026; files encrypted with ransomware. The EMR system was not involved. Exposed names, contact information and clinical counselling notes, plus employment information for employees. Notification letters were mailed October 2, 2026.
- The Speech Clinic: difficulties noticed August 10, 2026; forensics confirmed on August 17 remote access to a computer and an older server holding pre-2017 records. Access to patient data could not be ruled out. Exposed data ranges from name only to name, date of birth, SSN, diagnosis and medical information.
Remediação
Innovative Alternatives changed all system and user passwords and ran additional security scans. Cognitive Health Technologies reviewed its security policies and added protective measures.
Linha do tempo
-
Healthcare breaches: Cognitive Health Technologies (49,467), City Ambulance Service (Qilin), Baraga County Memorial Hospital (Wallstreet) and two others
ler a análise desta fonte ocultar
Five US healthcare organizations have disclosed data security incidents. The largest is Cognitive Health Technologies LLC (New York), where an unauthorized party had network access between February 5 and April 28, 2026 and acquired files with PHI of 49,467 individuals. The Qilin group claimed the attack on Viking Enterprises (City Ambulance Service) in Texas (14,324 individuals, 14 GB claimed), and Wallstreet ransomware claimed Baraga County Memorial Hospital in Michigan. Innovative Alternatives (Texas, about 1,500 people) suffered a ransomware attack, and The Speech Clinic (Georgia) had a computer and an old server with records of 2,168 patients remotely accessed.
Technical Details
- Cognitive Health Technologies: suspicious activity detected April 27, 2026; exposed names, dates of birth, health insurance information, medical histories and treatment information. No misuse identified.
- City Ambulance Service: reported to OCR on August 31, 2026 as an email-related hacking incident. Exposed names, addresses, dates of birth, medical and health insurance information, and Social Security numbers (per the Texas AG filing). Qilin's leak site listing dated July 19, 2026 claims 14 GB exfiltrated and published; the HIPAA Journal could not verify the claim, though proof screenshots include patient data. It is unclear whether ransomware was deployed.
- Baraga County Memorial Hospital: reported to OCR as a hacking/IT incident with a placeholder of 501+ individuals. Wallstreet listed the hospital on July 4, 2026 and leaked the data after the ransom was not paid.
- Innovative Alternatives: discovered August 2, 2026; files encrypted with ransomware. The EMR system was not involved. Exposed names, contact information and clinical counselling notes, plus employment information for employees. Notification letters were mailed October 2, 2026.
- The Speech Clinic: difficulties noticed August 10, 2026; forensics confirmed on August 17 remote access to a computer and an older server holding pre-2017 records. Access to patient data could not be ruled out. Exposed data ranges from name only to name, date of birth, SSN, diagnosis and medical information.
Remediation
Innovative Alternatives changed all system and user passwords and ran additional security scans. Cognitive Health Technologies reviewed its security policies and added protective measures.