Oregon Dental Practice Reports Two Data Breaches Affecting More Than 31,000 Patients
Data security incidents have been announced by the dental practices Hood River Dental in Oregon and Keep Smiling Dental Group in Ohio, and the multi-state senior living, rehabilitation, and skilled nursing provider Liberty Healthcare Group.
Hood River Dental, Oregon
Hood River Dental, an Oregon dental practice with two locations in Hood River, has recently reported two data security incidents to the HHS’ Office for Civil Rights, one involving unauthorized access to the protected health information of 16,609 individuals, and a second incident affecting 14,677 individuals. The first incident was identified by the practice on or around October 22, 2025. Steps were taken to contain the incident and ensure the security of its systems; then, on or around January 15, 2026, a second security incident occurred. Each incident was investigated, and it was confirmed on September 8, 2026, that in both incidents, patient data had been exposed.
Both incidents involved unauthorized access to similar types of information, which may have included first and last names, dates of birth, financial account information, payment card information, driver’s license numbers, Social Security numbers, medical record numbers, patient ID/account numbers, medical diagnoses, treatment information, and/or health insurance information. The practice said it takes data privacy and security seriously and is enhancing security to prevent similar incidents in the future.
Liberty Healthcare Group, North Carolina
Liberty Healthcare Group, the operator of senior living communities, nursing homes, and rehab facilities in North Carolina, South Carolina, Virginia, Tennessee, Louisiana, and Florida, is investigating a cybersecurity incident that was first identified on August 7, 2026. The affected systems were isolated, and an investigation was launched to determine the cause of suspicious activity, with assistance provided by third-party cybersecurity experts. While unauthorized access has been confirmed, Liberty Healthcare Group has not yet determined the number of affected individuals. Information compromised in the incident likely includes full names, addresses, birth dates, medical information, and health insurance information.
Your privacy respected – Read our privacy policy
Your privacy respected – Read our privacy policy
Notification letters will be mailed to the affected individuals when the data review is completed. The incident has been reported to regulators, and the HHS’ Office for Civil Rights breach portal lists the incident as affecting at least 501 individuals. The total will be updated when the file review is completed.
Keep Smiling Dental Group, Ohio
Keep Smiling Dental Group, a Beavercreek, Ohio-based family dental practice, is alerting patients about a cybersecurity incident that was identified on September 7, 2026, when it experienced a network disruption. An investigation was launched, which confirmed that an unauthorized third party had access to its computer network between August 29, 2026, and September 5, 2026, during which time files containing patient information were accessed or acquired. The affected files were reviewed to determine the individuals affected and types of data involved.
Keep Smiling Dental Group said the impacted information varies from individual to individual and may include names in combination with some or all of the following: address, phone number, email address, date of birth, patient ID, medical histories, dental records (including X-rays, treatment plans, and clinical notes), appointment/schedule information, dental insurance information, and dental account/billing information. A subset of patients also had their Social Security numbers exposed.
Several steps have been taken to improve security to prevent similar incidents in the future, including implementing additional cybersecurity measures, server-side security enhancements, and additional anti-phishing training for the workforce. The number of affected individuals has yet to be publicly disclosed.
The post Oregon Dental Practice Reports Two Data Breaches Affecting More Than 31,000 Patients appeared first on The HIPAA Journal.
Metabase Zero-Day Exploited in Dorsata Data Breach Affecting 58,000 Patients – The HIPAA Journal
Metabase Zero-Day Exploited in Dorsata Data Breach Affecting 58,000 Patients
Data breaches have recently been announced by the Virginia healthcare technology company Dorsata, the Florida mental healthcare provider Bay Area Psychological Consultants, and the Michigan urgent care provider Lansing Urgent Care.
Dorsata, Virginia
Dorsata, Inc., an Arlington, Virginia-based healthcare technology company whose products include electronic medical record software and data solutions tailored for women’s health providers, has recently disclosed a data breach to the HHS’ Office for Civil Rights involving the protected health information of 58,249 individuals.
Like many healthcare organizations, Dorsata uses Metabase business intelligence software. On or around August 12, 2026, Dorsata was informed that Metabase contained a previously unknown (zero-day) vulnerability. A patch was applied to fix the vulnerability, and cybersecurity experts were engaged to investigate whether the vulnerability had been exploited prior to patching.
The investigation confirmed that between August 10, 2026, and August 12, 2026, an unauthorized third party exploited the vulnerability and gained access to a database platform that contained medical information related to patients of its healthcare provider partners. The data review confirmed that the impacted information included names, addresses, patient IDs, dates of birth, vitals data, treatment information, treatment locations, provider names, vaccination information, medications, health insurance information, and medical histories contained in patient medical records.
Your privacy respected – Read our privacy policy
Your privacy respected – Read our privacy policy
While data was exposed, no evidence was found to suggest that any of the information has been misused. The group behind the initial exploitation of the vulnerability has not been established; however, the Dire Wolf group appears to have exploited the vulnerability in at least two subsequent attacks, according to VenariX.
Bay Area Psychological Consultants, Florida
Bay Area Psychological Consultants, a Niceville, Florida-based mental health clinic, has started notifying 5,679 patients that some of their protected health information has been exposed in a recent cybersecurity incident. The incident involved its third-party technology service provider CareCloud. Bay Area Psychological Consultants explained that CareCloud experienced a network disruption on March 16, 2026, that impacted one of CareCloud’s electronic health record environments.
CareCloud’s investigation determined that an unauthorized third party accessed one of its AWS environments between March 10 and March 16, 2026, and claimed to have exfiltrated data. The unauthorized access was terminated on March 16, 2026, and no further unauthorized activity has been detected since. The exposed files were reviewed and found to contain names, email addresses, dates of birth, medical record numbers, Social Security numbers, treatment locations, appointment information, and provider information. Bay Area Psychological Consultants said it is unaware of any misuse of patient data as a result of the incident but has advised all affected individuals to remain vigilant against identity theft, fraud, and other misuses of their personal and protected health information.
Lansing Urgent Care, Michigan
Lansing Urgent Care in Michigan has recently disclosed a cybersecurity incident that was first identified on September 11, 2026. According to its website notice, “certain data was accessed and exposed by an unauthorized third party.” The nature of the attack was not disclosed; however, this appears to have been a ransomware attack.
The INC Ransom ransomware group claimed responsibility and added Lansing Urgent Care to its dark web data leak site. Lansing Urgent Care said the review of the affected data is ongoing; however, the information compromised in the incident likely includes names, addresses, dates of birth, diagnoses, treatment information, prescriptions, and health insurance information. The information involved varies from individual to individual. The affected individuals have been advised to monitor their free credit reports over the next 12 to 24 months. The number of affected individuals has yet to be publicly disclosed.
The post Metabase Zero-Day Exploited in Dorsata Data Breach Affecting 58,000 Patients appeared first on The HIPAA Journal.
Health Data Access Advances, but Privacy and Security Must Keep Pace, Panelists Say – HCI Innovation Group
Health Data Access Advances, but Privacy and Security Must Keep Pace, Panelists Say HCI Innovation Group
Why Aesthetic Clinics Are Rebuilding Growth Around Conversion Systems – TechBullion
HIPAA MEDIA NOTICE – StreetInsider
HIPAA MEDIA NOTICE StreetInsider
Minnesota Epilepsy Group Falls Victim to Second 2026 Cyberattack
Minnesota Epilepsy Group, P.A., a Level 4 Epilepsy Center in Roseville, Minnesota, has announced that it has fallen victim to its second cyberattack of the year. The first incident involved unauthorized access to its network between March 16, 2026, and April 10, 2026, and affected 80,061 individuals. The latest incident occurred four months after the previous unauthorized access was terminated and affected a similar number of individuals: 82,574. It is unclear if the two incidents are related.
The latest incident was detected on August 10, 2026. Steps were taken to secure its network, and an internal investigation was launched to determine the nature and scope of the unauthorized activity. The investigation confirmed that an unauthorized third party had access to parts of its network on August 10, 2026. The files on the compromised parts of its network were reviewed, and on September 17, 2026, Minnesota Epilepsy Group confirmed that personal and protected health information had been compromised. The types of data involved varied from individual to individual and included names in combination with one or more of the following: address, dates of birth, Social Security number, medical treatment information, and health insurance information.
Notification letters started to be mailed to the affected individuals on October 16, 2026. At the time of issuing notification letters, no misuse of patient data had been identified. As a precaution against identity theft and fraud, individuals whose Social Security numbers were involved have been offered complimentary credit monitoring and identity theft protection services. Minnesota Epilepsy Group said it had previously taken steps to improve security and will be implementing additional cybersecurity measures to prevent similar incidents in the future.
Hospice of Murray County
Hospice of Murray County in Slayton, Minnesota, has identified unauthorized access to one of its computer servers. The incident occurred on August 24, 2026, and the investigation confirmed that the server contained the protected health information of approximately 800 individuals, including names and other identifying information, Social Security numbers, medical information, other protected health information, and Social Security numbers. In an October 13, 2026, website notice, Hospice of Murray County said the investigation is ongoing; however, no evidence has been found to indicate that patient information was accessed or acquired.
Your privacy respected – Read our privacy policy
Your privacy respected – Read our privacy policy
The post Minnesota Epilepsy Group Falls Victim to Second 2026 Cyberattack appeared first on The HIPAA Journal.