A series of newly disclosed cyber incidents is affecting healthcare organizations across the U.S., exposing millions of patient records while also disrupting systems used to deliver care.
Aesto Health has confirmed a breach affecting 9.54 million people and at least 30 healthcare provider clients, making it the second-largest confirmed healthcare data breach of 2026 to date. Hackers accessed Aesto’s AWS environment and stole information that included SSNs, financial account information, medical histories, health records, insurance information and claims and billing data.
Separately, Nutex Health, which operates 27 hospitals and outpatient facilities across 12 states, confirmed that attackers stole patient, employee and healthcare provider information along with confidential business and financial data. The attackers are now threatening to publish the stolen information.
Meanwhile, Luminis Health is dealing with an active cyberattack that has made certain systems unavailable across its Maryland healthcare network, affecting access to some patient services.
Damon Small, Board of Directors, Xcape, Inc.:
“Three separate healthcare cybersecurity incidents in three weeks represent an alarming escalation that directly threatens patient care alongside data privacy. The disruption across Aesto Health, Nutex Health, and Luminis Health demonstrates that the operational risk extends far beyond exfiltrated protected health information (PHI) or regulatory fines. When cyber incidents cut off access to electronic health record (EHR) systems, clinical operations grind to a halt, delaying necessary care and risking patient safety. Healthcare providers have historically viewed IT systems as ancillary, underfunding them both operationally and fiscally. These recent events provide a definitive signal that clinical IT infrastructure is just as essential to positive patient outcomes as doctors, nurses, and medical machinery. To protect patient safety and maintain clinical continuity, healthcare executives must elevate IT security to a core operational priority, enforce strict third-party vendor risk controls, restrict network exposure, and maintain offline, immutable backups.
“Critical Takeaways:
- Clinical IT infrastructure directly affects patient care delivery, making its defense as vital to health outcomes as doctors, nurses, or medical equipment.
- EHR downtime and business associate breaches create immediate operational paralysis that extends far beyond health record theft.
- Health system leadership must stop treating IT as an ancillary back-office expense and fund operational technology security accordingly.
“Treating hospital IT like an ancillary expense works right up until the emergency room is forced back to pen and paper.”
John Strand, Owner, Black Hills Information Security, Inc.:
“I am deeply concerned that breaches of this scale and magnitude aren’t even making it into mainstream media anymore.
“If you go back ten years or so, something like this would have been front-page news. But these breaches have happened so frequently, and the story is essentially the same story repeated over and over again with a different organization’s name attached to it, that I think a lot of media outlets simply don’t want to run them anymore. People don’t click on those articles like they used to.
“And I think that’s where the real danger is.
“We’re becoming numb to breaches of this magnitude. Unless you’re one of the people or organizations directly impacted, a massive cybersecurity breach barely registers on the radar for most Americans anymore.
“That normalization should concern us. The breaches haven’t become less serious. We’ve just become accustomed to them.”
Denis Calderone, CTO, Suzu Labs:
“Healthcare as a sector is having a bad year. Luminis Health in Maryland is the most recent, with systems still down and patients calling a phone number instead of logging into MyChart. The Gentlemen ransomware group is threatening to publish stolen data from Nutex Health’s 27 hospitals. Aesto Health had a breach back in December that took five months to confirm, and the number just landed on the HHS breach portal this week at 9.5 million patients across 30 providers. Two days ago it was McKesson and 284 million claimed records. DentaQuest already set the high mark for the year at 15 million. And this is just what’s making headlines right now.
“The legal and regulatory machinery is now moving as fast as the attacks. Nutex disclosed the breach to the SEC on August 24. A class action was filed in Texas three days later. That’s before the company even finished determining what was stolen. The Aesto breach happened in December 2025, wasn’t confirmed until May 2026, and is now the second-largest healthcare breach of the year at 9.5 million individuals. In April, HHS’s Office for Civil Rights settled four separate ransomware investigations for a combined $1.165 million, and the root finding in every single one was the same: failure to conduct an adequate risk analysis. Data breach class action filings went from 604 in 2022 to nearly 1,500 in 2024, and healthcare is feeding that pipeline faster than any other sector. The window between breach disclosure and lawsuit has effectively collapsed.
“The Gentlemen ransomware group went from emergence in mid-2025 to over 675 claimed attacks, with healthcare as their second most targeted sector. Aesto was breached in December, and confirmation didn’t come until May. Meanwhile, the legal bar for what constitutes reasonable cybersecurity in healthcare is already set, and it’s set by freely available government guidance. Plaintiffs’ attorneys are citing HIPAA Security Rule requirements and published CISA recommendations to establish a standard of care in court. The proposed Security Rule update isn’t creating new expectations. It’s codifying what juries are already being told is the baseline. If your organization can’t demonstrate its meeting that bar today, the breach is only the first problem.”
Healthcare is a sector that is targeted by hackers. Which means that if you are in healthcare, you need to defend yourself accordingly
Related
This entry was posted on September 2, 2026 at 5:03 pm and is filed under Commentary. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Cyber incidents hit millions of patients, disrupt hospital systems
A series of newly disclosed cyber incidents is affecting healthcare organizations across the U.S., exposing millions of patient records while also disrupting systems used to deliver care.
Aesto Health has confirmed a breach affecting 9.54 million people and at least 30 healthcare provider clients, making it the second-largest confirmed healthcare data breach of 2026 to date. Hackers accessed Aesto’s AWS environment and stole information that included SSNs, financial account information, medical histories, health records, insurance information and claims and billing data.
Separately, Nutex Health, which operates 27 hospitals and outpatient facilities across 12 states, confirmed that attackers stole patient, employee and healthcare provider information along with confidential business and financial data. The attackers are now threatening to publish the stolen information.
Meanwhile, Luminis Health is dealing with an active cyberattack that has made certain systems unavailable across its Maryland healthcare network, affecting access to some patient services.
Damon Small, Board of Directors, Xcape, Inc.:
“Three separate healthcare cybersecurity incidents in three weeks represent an alarming escalation that directly threatens patient care alongside data privacy. The disruption across Aesto Health, Nutex Health, and Luminis Health demonstrates that the operational risk extends far beyond exfiltrated protected health information (PHI) or regulatory fines. When cyber incidents cut off access to electronic health record (EHR) systems, clinical operations grind to a halt, delaying necessary care and risking patient safety. Healthcare providers have historically viewed IT systems as ancillary, underfunding them both operationally and fiscally. These recent events provide a definitive signal that clinical IT infrastructure is just as essential to positive patient outcomes as doctors, nurses, and medical machinery. To protect patient safety and maintain clinical continuity, healthcare executives must elevate IT security to a core operational priority, enforce strict third-party vendor risk controls, restrict network exposure, and maintain offline, immutable backups.
“Critical Takeaways:
“Treating hospital IT like an ancillary expense works right up until the emergency room is forced back to pen and paper.”
John Strand, Owner, Black Hills Information Security, Inc.:
“I am deeply concerned that breaches of this scale and magnitude aren’t even making it into mainstream media anymore.
“If you go back ten years or so, something like this would have been front-page news. But these breaches have happened so frequently, and the story is essentially the same story repeated over and over again with a different organization’s name attached to it, that I think a lot of media outlets simply don’t want to run them anymore. People don’t click on those articles like they used to.
“And I think that’s where the real danger is.
“We’re becoming numb to breaches of this magnitude. Unless you’re one of the people or organizations directly impacted, a massive cybersecurity breach barely registers on the radar for most Americans anymore.
“That normalization should concern us. The breaches haven’t become less serious. We’ve just become accustomed to them.”
Denis Calderone, CTO, Suzu Labs:
“Healthcare as a sector is having a bad year. Luminis Health in Maryland is the most recent, with systems still down and patients calling a phone number instead of logging into MyChart. The Gentlemen ransomware group is threatening to publish stolen data from Nutex Health’s 27 hospitals. Aesto Health had a breach back in December that took five months to confirm, and the number just landed on the HHS breach portal this week at 9.5 million patients across 30 providers. Two days ago it was McKesson and 284 million claimed records. DentaQuest already set the high mark for the year at 15 million. And this is just what’s making headlines right now.
“The legal and regulatory machinery is now moving as fast as the attacks. Nutex disclosed the breach to the SEC on August 24. A class action was filed in Texas three days later. That’s before the company even finished determining what was stolen. The Aesto breach happened in December 2025, wasn’t confirmed until May 2026, and is now the second-largest healthcare breach of the year at 9.5 million individuals. In April, HHS’s Office for Civil Rights settled four separate ransomware investigations for a combined $1.165 million, and the root finding in every single one was the same: failure to conduct an adequate risk analysis. Data breach class action filings went from 604 in 2022 to nearly 1,500 in 2024, and healthcare is feeding that pipeline faster than any other sector. The window between breach disclosure and lawsuit has effectively collapsed.
“The Gentlemen ransomware group went from emergence in mid-2025 to over 675 claimed attacks, with healthcare as their second most targeted sector. Aesto was breached in December, and confirmation didn’t come until May. Meanwhile, the legal bar for what constitutes reasonable cybersecurity in healthcare is already set, and it’s set by freely available government guidance. Plaintiffs’ attorneys are citing HIPAA Security Rule requirements and published CISA recommendations to establish a standard of care in court. The proposed Security Rule update isn’t creating new expectations. It’s codifying what juries are already being told is the baseline. If your organization can’t demonstrate its meeting that bar today, the breach is only the first problem.”
Healthcare is a sector that is targeted by hackers. Which means that if you are in healthcare, you need to defend yourself accordingly
Share this:
Like this:
Related
This entry was posted on September 2, 2026 at 5:03 pm and is filed under Commentary. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.