Five Small Healthcare Organizations Report Data Breaches Exposing Patient Information
Five small healthcare providers across the U.S. have recently disclosed security incidents involving unauthorized access to patient data, with ransomware groups claiming responsibility in multiple cases.
Family Medical Associates of Raleigh (North Carolina)
On May 7, 2026, the Raleigh-based multi-provider practice detected a cybersecurity incident, later confirmed as a breach between April 18–20, 2026. An unauthorized third party accessed and potentially exfiltrated files containing protected health information (PHI), including names, medical records, insurance details, financial data, and government-issued ID numbers. While no misuse has been reported, the investigation remains ongoing. The Genesis ransomware group claimed responsibility.
Arkansas Oral & Maxillofacial Surgeons (Arkansas)
The Hot Springs-based dental and cosmetic surgery provider identified a breach on April 7, 2026, later confirming on June 2 that an unauthorized party accessed and stole patient files. Exposed data includes names, birth dates, Social Security numbers, treatment records, and payment information. Affected individuals were notified by mail, though credit monitoring services were not offered. The PEAR threat group, known for data theft and extortion, claimed the attack.
Alpine Agency of the Midlands (South Carolina)
The Columbia-based health insurance agency reported unauthorized access to an employee email account in November 2025, with the breach occurring on October 28, 2026. Emails and attachments containing names, addresses, birth dates, and limited Social Security numbers may have been copied. The incident was reported to the HHS’ Office for Civil Rights as affecting at least 500 individuals, with notifications pending completion of the review.
Princeton Family Eye Care (Texas)
The Princeton, Texas, optometry practice detected suspicious email activity on May 4, 2026, confirming unauthorized access to a company account. A data review revealed exposure of names, birth dates, government IDs, and limited medical information for 933 Texas residents. No misuse has been identified, but patients were advised to monitor for fraud.
James C. Standring, DDS (California)
The Crescent City dental practice notified 6,658 patients of a historical breach first discovered on September 2, 2024, but only reported to regulators on July 17, 2026. Unauthorized access exposed names, Social Security numbers, medical records, and financial data. No misuse has been reported, though the 22-month delay in notification was unexplained.
The incidents highlight ongoing cybersecurity risks in small healthcare organizations, with ransomware and extortion groups increasingly targeting sensitive patient data.
Source: https://www.hipaajournal.com/data-breaches-five-small-healthcare-organizations/
Allied OMS cybersecurity rating report: https://www.rankiteo.com/company/allied-oms
"id": "ALL1786569916",
"linkid": "allied-oms",
"type": "Ransomware",
"date": "4/2026",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'healthcare',
'location': 'Raleigh, North Carolina, U.S.',
'name': 'Family Medical Associates of Raleigh',
'size': 'small',
'type': 'healthcare_provider'},
{'industry': 'healthcare',
'location': 'Hot Springs, Arkansas, U.S.',
'name': 'Arkansas Oral & Maxillofacial Surgeons',
'size': 'small',
'type': 'healthcare_provider'},
{'customers_affected': '500+',
'industry': 'healthcare',
'location': 'Columbia, South Carolina, U.S.',
'name': 'Alpine Agency of the Midlands',
'size': 'small',
'type': 'health_insurance_agency'},
{'customers_affected': '933',
'industry': 'healthcare',
'location': 'Princeton, Texas, U.S.',
'name': 'Princeton Family Eye Care',
'size': 'small',
'type': 'healthcare_provider'},
{'customers_affected': '6658',
'industry': 'healthcare',
'location': 'Crescent City, California, U.S.',
'name': 'James C. Standring, DDS',
'size': 'small',
'type': 'healthcare_provider'}],
'attack_vector': ['unauthorized_access', 'email_compromise'],
'customer_advisories': ['monitor_for_fraud', 'credit_monitoring_not_offered'],
'data_breach': {'data_exfiltration': 'yes',
'file_types_exposed': ['files', 'emails', 'attachments'],
'personally_identifiable_information': 'yes',
'sensitivity_of_data': 'high',
'type_of_data_compromised': ['protected_health_information',
'personally_identifiable_information',
'financial_data',
'medical_records',
'insurance_details',
'government-issued_ID_numbers',
'Social_Security_numbers',
'payment_information']},
'description': 'Five small healthcare providers across the U.S. have recently '
'disclosed security incidents involving unauthorized access to '
'patient data, with ransomware groups claiming responsibility '
'in multiple cases.',
'impact': {'data_compromised': 'protected health information (PHI), '
'personally identifiable information (PII), '
'financial data, medical records, insurance '
'details, government-issued ID numbers, Social '
'Security numbers, payment information',
'identity_theft_risk': 'high',
'payment_information_risk': 'high'},
'investigation_status': 'ongoing',
'lessons_learned': 'The incidents highlight ongoing cybersecurity risks in '
'small healthcare organizations, with ransomware and '
'extortion groups increasingly targeting sensitive patient '
'data.',
'motivation': ['data_theft', 'extortion'],
'ransomware': {'data_exfiltration': 'yes',
'ransomware_strain': ['Genesis', 'PEAR']},
'regulatory_compliance': {'regulations_violated': ['HIPAA'],
'regulatory_notifications': ['HHS’ Office for Civil '
'Rights']},
'response': {'communication_strategy': ['patient_notifications',
'regulatory_reporting']},
'threat_actor': ['Genesis ransomware group', 'PEAR threat group'],
'title': 'Five Small Healthcare Organizations Report Data Breaches Exposing '
'Patient Information',
'type': ['data_breach', 'ransomware']}