PlayStation 5 Lifespan Extended to 2029, Next-Gen Delay Confirmed

Federal Inquiry Reveals Widespread Data Breaches at Healthcare Institutions

A federal investigation, concluded January 26, 2026, has uncovered extensive data breaches affecting at least 67 healthcare institutions across the United States. The breaches compromised the personal information of over 43 million patients, according to a report released today by the Department of Health and Human Services (HHS) and the FBI.

Key Findings of the Investigation

• Number of Affected institutions: 67 hospitals, clinics, and healthcare providers experienced confirmed data breaches.
• Number of Patients Affected: 43,287,912 patient records where compromised.
• Types of Data Breached: Compromised data includes names, dates of birth, social security numbers, medical diagnoses, and insurance information.
• Attribution: The investigation attributes the breaches to a coordinated cyberattack campaign originating from a known threat actor group, “Black Serpent,” based in Eastern Europe. The FBI issued a formal attribution statement here.

Institutions Confirmed to be Affected

While the full list of affected institutions remains confidential to protect ongoing investigations, the following organizations have publicly confirmed their involvement:

• Massachusetts General Hospital (Boston, MA): Confirmed a breach affecting 2.1 million patient records. https://www.massgeneral.org/
• university of California san Francisco Health (San Francisco, CA): Reported a breach impacting 1.5 million patient records. https://www.ucsfhealth.org/
• NorthShore University HealthSystem (Evanston, IL): Confirmed a breach affecting 875,000 patient records. https://www.northshore.org/
• Ascension Health (St. Louis, MO): Reported a breach impacting 5.2 million patient records. https://www.ascension.org/
• CommonSpirit Health (Chicago, IL): Confirmed a breach affecting 7.8 million patient records. https://www.commonspirit.org/

Federal Response and Recommendations

The HHS and FBI are working with affected institutions to mitigate the damage and strengthen cybersecurity defenses. HHS Secretary Xavier Becerra stated, “protecting patient data is paramount. We are committed to holding those responsible for these attacks accountable and assisting healthcare providers in bolstering their security measures.”

“Healthcare organizations are increasingly targeted by cybercriminals due to the high value of protected health information. This investigation underscores the urgent need for improved cybersecurity practices across the healthcare sector.”

FBI Director Christopher Wray, January 26, 2026

The agencies recommend that healthcare organizations:

1. Implement multi-factor authentication for all systems.
2. Regularly update software and security patches.
3. Conduct complete cybersecurity risk assessments.
4. Train employees on recognizing and reporting phishing attempts.
5. Develop and test incident response plans.

Patients are advised to monitor their credit reports and be vigilant for signs of identity theft.The Federal Trade Commission (FTC) offers resources for identity theft protection at https://www.identitytheft.gov/.