University Hospitals Cyberattack Knocks Systems Offline; EyeMed and Facial Surgery Group Disclose Separate Data Breaches
This roundup covers three distinct healthcare security incidents. University Hospitals, a 21-hospital system in Cleveland, Ohio, identified a cyberattack on October 22, 2026, and took systems offline, including its MyChart patient portal. As of a November 2 update, systems remained offline with no restoration timeline; the nature of the attack and whether ransomware was involved has not been disclosed, and no ransomware group has claimed responsibility. Hospitals and clinics remain open but pre-authorizations, appointments, and elective procedures have been disrupted, and patient data impact is still under investigation. Separately, EyeMed Vision Care disclosed that a single misdirected email sent on September 22, 2026, exposed members' names, addresses, dates of birth, Social Security numbers, and membership IDs due to human error; at least 500 California residents are confirmed affected. Facial Surgery Group, operating five oral and maxillofacial surgery centers in Missouri, confirmed that an email account compromise detected on November 24, 2025, exposed data of 11,407 individuals, including SSNs, financial account numbers, and health information.
Detalhes técnicos
- University Hospitals: incident identified October 22, 2026; incident response and containment measures activated, including taking MyChart and other digital services offline. Cause and ransomware involvement undisclosed; no group has claimed responsibility.
- EyeMed Vision Care: a single email containing member data was sent to an incorrect recipient on September 22, 2026, due to human error (no malicious actor involved).
- Facial Surgery Group: unauthorized access to a single email account detected November 24, 2025; third-party cybersecurity experts and a data mining company reviewed the account, with review completed September 9, 2026. Affected individuals were notified October 9, 2025 (as stated, though this predates the review completion date per the article).
Remediação
University Hospitals continues restoration efforts with no set timeline. EyeMed has revised privacy and operations policies, updated training, retrained staff, and offered complimentary credit monitoring and identity theft protection. Facial Surgery Group has taken unspecified steps to prevent recurrence and offered affected individuals complimentary credit monitoring and identity theft restoration services.
Linha do tempo
-
University Hospitals Cyberattack Knocks Systems Offline; EyeMed and Facial Surgery Group Disclose Separate Data Breaches
ler a análise desta fonte ocultar
This roundup covers three distinct healthcare security incidents. University Hospitals, a 21-hospital system in Cleveland, Ohio, identified a cyberattack on October 22, 2026, and took systems offline, including its MyChart patient portal. As of a November 2 update, systems remained offline with no restoration timeline; the nature of the attack and whether ransomware was involved has not been disclosed, and no ransomware group has claimed responsibility. Hospitals and clinics remain open but pre-authorizations, appointments, and elective procedures have been disrupted, and patient data impact is still under investigation. Separately, EyeMed Vision Care disclosed that a single misdirected email sent on September 22, 2026, exposed members' names, addresses, dates of birth, Social Security numbers, and membership IDs due to human error; at least 500 California residents are confirmed affected. Facial Surgery Group, operating five oral and maxillofacial surgery centers in Missouri, confirmed that an email account compromise detected on November 24, 2025, exposed data of 11,407 individuals, including SSNs, financial account numbers, and health information.
Technical Details
- University Hospitals: incident identified October 22, 2026; incident response and containment measures activated, including taking MyChart and other digital services offline. Cause and ransomware involvement undisclosed; no group has claimed responsibility.
- EyeMed Vision Care: a single email containing member data was sent to an incorrect recipient on September 22, 2026, due to human error (no malicious actor involved).
- Facial Surgery Group: unauthorized access to a single email account detected November 24, 2025; third-party cybersecurity experts and a data mining company reviewed the account, with review completed September 9, 2026. Affected individuals were notified October 9, 2025 (as stated, though this predates the review completion date per the article).
Remediation
University Hospitals continues restoration efforts with no set timeline. EyeMed has revised privacy and operations policies, updated training, retrained staff, and offered complimentary credit monitoring and identity theft protection. Facial Surgery Group has taken unspecified steps to prevent recurrence and offered affected individuals complimentary credit monitoring and identity theft restoration services.