Was It Breached Secria

Healthcare data breaches in 2026: what the federal list shows

The federal health breach list holds 422 reports submitted in 2026, covering 77,958,031 people in total. Almost all were hacking or IT incidents.1

  1. DentaQuest15,000,000
  2. Aesto9,540,683
  3. iRhythm Technologies8,179,772
  4. AdaptHealth4,115,802
  5. Unlimited Technology Systems3,803,750
  6. CareCloud3,756,469
  7. TriZetto Provider Solutions3,433,965
  8. QualDerm Partners2,951,318
  9. Baylor Genetics2,810,878
  10. Nacogdoches Memorial Hospital2,507,073
The ten largest reports submitted from 1 January 2026, as listed on the HHS breach portal on 4 November 2026.1 A listing reports a notice the organization filed; it isn't a finding that it was at fault.

Select a name for the table below. Checked 4 November 2026 against the sources.

The largest twelve, and where to read more

Every row is a hacking or IT incident. Where we've checked the breach against the company's letter, the name links to its page.1

OrganizationTypePeopleSubmitted
DentaQuest, LLCHealth plan15,000,00016 Jul 2026
Aesto, LLCBusiness associate9,540,68331 Jul 2026
iRhythm Technologies, Inc.Healthcare provider8,179,7723 Oct 2026
AdaptHealth, LLCHealthcare provider4,115,80214 Aug 2026
Unlimited Technology Systems, LLCBusiness associate3,803,75021 Jul 2026
CareCloud, Inc.Business associate3,756,46924 Jul 2026
TriZetto Provider SolutionsBusiness associate3,433,9656 Feb 2026
QualDerm Partners, LLCHealthcare provider2,951,31822 Feb 2026
Baylor GeneticsHealthcare provider2,810,87814 Aug 2026
Nacogdoches Memorial HospitalHealthcare provider2,507,07330 Mar 2026
Navia Benefit Solutions, Inc.Business associate2,151,33018 Mar 2026
Insightin Health, Inc.Business associate1,949,53416 Jan 2026

2026 so far, in three numbers

Counted from the portal's full export on 4 November 2026. The counts add up reports, not unique people: one person can be in several.1

398 of 422

Reports filed as a hacking or IT incident. They cover all but 73,302 of the people counted.1

75 reports, 31,213,855 people

Filed by business associates: companies working for a provider or health plan, which must tell that provider or plan about a breach.1,2

33,510,062 in July

The biggest month by people: 67 reports, including DentaQuest, Aesto, Unlimited Technology Systems and CareCloud.1

How a breach gets on the list

The rules are in the HIPAA breach notification rule. This is a summary, not legal advice.

500 people or more: reported as it happens

The provider or plan must tell you without unreasonable delay and within 60 calendar days of discovering the breach, and tell HHS at the same time. Over 500 residents of one state also means notice to media there.2 HHS must post these reports.1

Fewer than 500: once a year

Smaller breaches go in a log and reach HHS within 60 days after the end of the year, so they don't appear on this list as they happen.2 A business associate tells the provider or plan within 60 days, and the provider or plan reports it.2

Questions people ask

What is the HHS breach portal?

The list the Department of Health and Human Services must post, under section 13402(e)(4) of the HITECH Act, of breaches of health information affecting 500 or more people. The main page shows reports from the last 24 months still under investigation; older or closed ones sit on its Archive page.1

What was the largest healthcare data breach of 2026?

On the list as of 4 November 2026: DentaQuest's report of 15,000,000 people, submitted 16 July 2026.1 Its page has the letter and what to do.

Why isn't the breach in my letter on the list?

It may have affected fewer than 500 people, which is reported once a year.2 It may not involve a HIPAA provider, plan or business associate at all: Medtronic, for example, isn't on the list.1 Or it was posted late: the newest report on 4 November 2026 was submitted on 9 October.1

I got a letter from a company I've never used. Why?

Often it's a business associate working for your provider or plan; on this site, TriZetto, Unlimited Technology Systems and Navia are examples. The rule makes it tell your provider or plan, which must then tell you.2 Our letter check shows how to confirm it.

Sources 2
  1. Breach Portal: HIPAA cases currently under investigation, U.S. Department of Health and Human Services, Office for Civil Rights. Full list exported as CSV (759 rows; 422 submitted from 1 January 2026, the latest on 9 October 2026). Read 4 November 2026.
  2. 45 CFR Part 164, Subpart D: notification in the case of breach of unsecured protected health information, sections 164.404 to 164.410, Electronic Code of Federal Regulations. Read 4 November 2026.

Every number comes from the federal list or the rule itself, and every source shows the day we read it. How we check