Healthcare organizations reported 42 breaches affecting 500 or more people to the US Department of Health and Human Services (HHS) in September 2026, exposing the records of 1,043,266 people, according to a Paubox breach report published October 16. Two incidents account for more than half of that total, and they were very different kinds of failure.
What happened
Paubox tallies breaches posted to the HHS reporting portal. The largest two were:
- District of Columbia Department of Health Care Finance: 399,086 people. The agency told HHS about an exposure rather than a cyberattack: two reports on its public website contained hidden personal data meant to show only summary statistics. Security Affairs reports the data included Medicaid IDs, dates of birth, provider names, race, gender, ethnicity and ward, but not names, Social Security numbers or financial information. The agency says it learned of the issue on July 21, 2026, removed the reports, and has no evidence the data was accessed or misused.
- Clover Health: 138,677 people. Becker’s Payer Issues reports an unauthorized party accessed three employee accounts on July 3 and 4. Most affected people had names, birth dates, account numbers and insurance identifiers; a smaller group had service dates and provider names, and fewer than 70 cases involved government identifiers such as Social Security numbers. Clover has not been reported to have said how the accounts were compromised.
The Paubox report itself does not state the incident type for either breach; those details come from the separate reports linked below.
Where the damage came from
| Breach type | Incidents | People affected |
|---|---|---|
| Network server | 30 | 578,713 |
| Electronic medical record | 3 | 414,273 |
| 8 | not listed | |
| Other | not listed | 139,503 |
Network server breaches were the most common, at 30 incidents, up from 22 in the 2025 figure the report cites. Email was next at 8, and the report says it has stayed a frequent attack route for five years.
Why it matters
The report says electronic medical record breaches affected 414,273 people, up from 16,281 in the 2025 figure it cites. Only three incidents produced that total, so a few large cases drive it. A single large breach can swing a category’s comparison, which is worth keeping in mind before reading it as a trend. Network server breaches went the other way in people affected: 578,713, below the 2025 figure of 1,359,914, which the report describes as the lowest in five years.
The DC case is also a reminder that not every large health breach involves an attacker. Misconfigured public reports can expose data for years, and the agency says the underlying data may have been reachable from 2023 until July 2026.
What to do
- Read the notice. It should say what was exposed. Medical record numbers and insurance IDs call for different steps than Social Security numbers.
- Check your insurance statements. Look at explanation of benefits forms for care you did not receive.
- Freeze your credit if a Social Security number was involved.
- Ask the provider for a copy of your records and the accounting of disclosures if anything looks wrong.
The steps above are our analysis, not guidance from the sources.
What we still do not know
The report covers only breaches posted to HHS in one month, and totals can change as organizations update filings. It does not say how most network server breaches happened, and Clover has not been reported to have explained how the three accounts were accessed.
Sources: Paubox, HIPAA breach report (Oct 16, 2026); Security Affairs, DC Department of Health Care Finance exposure (Sep 28, 2026); Becker’s Payer Issues, Clover data breach (Oct 2, 2026).
Leave a Reply