Healthcare data breaches fell in August, but 2026 is still on a bad pace

Fewer healthcare data breaches were reported in August, but the year is still heading the wrong way. Healthcare organizations told the U.S. Department of Health and Human Services about 52 large breaches that month, down 34% from July. Still, 593 have been reported so far in 2026, up 6.7% from 556 at this point last year.

What changed

August's 52 breaches were the second-lowest monthly total in the past 12 months. The monthly average over that period is 66. At least 8,377,327 people had their health information exposed or accessed, a 75% drop from July. July was one of the worst months in recent history, with more than 33 million people affected.

The biggest breaches

The largest was at AdaptHealth, a company that provides home medical equipment, diabetes supplies and sleep therapy products. More than 4.1 million people were affected. A member of the ShinyHunters data theft and extortion group contacted the company in June and said its network had been accessed and data taken. The theft was later confirmed.

The second largest hit Baylor Genetics, a clinical genomics company. An unknown hacker reached parts of its network holding data on more than 2.8 million patients.

Seventeen August breaches affected more than 10,000 people each. All but two were hacking incidents. One of the other two involved a former facilitator who stole data and tried to sell it to someone else.

The bigger picture

Last year set the record, with 807 large breaches. This year, 78.6 million people have already had their health information exposed, up 14.8% from the same point last year. Hacking incidents are up only 0.9% in number, but the people affected by them are up 18.7%, to 74,315,731.

Hacking and other IT incidents made up 78.8% of August's breaches and 98% of the people affected. Network servers were the most common place data was exposed, followed by email accounts.

Numbers may grow

When a company does not yet know how many people were affected, it can report a placeholder, usually 500 or 501. Seven August incidents were reported that way. They likely affected far more people than the first report shows.

The government's breach list also shows who reported a breach, not always where it happened. A breach at a vendor that works for your provider can still lead to a notice from the provider.

What to do

• Open and read any breach notice you receive, even if you have never heard of the company involved.
• Be wary of unexpected calls or emails about your health, insurance or bills.
• Do not share personal details with a caller or sender you did not expect.