NetSec.news

Allina Health System has agreed to pay $12.5 million to resolve litigation alleging that website tracking technologies disclosed personally identifiable information (PII) and protected health information (PHI) to third parties, while the health system continues to deny wrongdoing and liability. Nonprofit health system, Allina Health System, based in Minneapolis, Minnesota reached a proposed settlement in litigation concerning its use of website tracking technologies, including pixels.

iRhythm Holdings Inc., a publicly traded manufacturer of heart monitoring devices, disclosed a cybersecurity incident involving unauthorized access to business applications hosted on a third-party platform. The incident was first identified on June 8, 2026 and was reported to the U.S. Securities and Exchange Commission through a regulatory filing.

Bartholomew County Public Hospital doing business as Columbus Regional Health has agreed to settle a class action lawsuit alleging that confidential patient information was disclosed to third-party tracking technologies through its website without patient consent. Columbus Regional Health denies the allegations and states that it agreed to resolve the litigation to avoid the expense, burden, and uncertainty of continued legal proceedings.

Henderson & Walton Women’s Center has agreed to resolve a class action lawsuit arising from a 2022 data breach that exposed the personal data and protected health information (PHI) of 34,306 individuals. Henderson & Walton Women’s Center, a women’s healthcare provider based in Birmingham, Alabama, agreed to resolve litigation linked to a data security incident involving unauthorized access to patient information.

HIPAA CyberSecurity Requirements require HIPAA-covered Entities and HIPAA Business Associates to maintain a documented security program that protects electronic protected health information through risk analysis, administrative safeguards, physical safeguards, technical safeguards, cybersecurity training, vendor oversight, incident response, backup planning, and evidence of remediation.

DentaQuest is managing a cybersecurity incident involving unauthorized access to a limited part of its network, while leaked data associated with the incident contains records tied to 2.6 million individuals following a claimed data theft by the ShinyHunters group.

Silent Ransom Group is conducting a social engineering campaign that impersonates IT support staff to gain access to organizational systems and exfiltrate sensitive data from targeted organizations. Silent Ransom Group, also known as Luna Moth, Chatty Spider, and UNC3753, is a financially motivated threat group that targets law firms, healthcare organizations, insurance companies, and finance organizations.

Oglethorpe, a mental health and addiction recovery treatment facilities in Tampa, Florida, has agreed to litigation settlement connected to a June 2025 hacking incident that involved the theft of personal and protected health information (PHI) of 92,000 current and former patients and employees. Oglethorpe discovered a hacking incident in June 2025.

Southern Illinois Healthcare Enterprises, Southern Illinois Hospital Services, and Southern Illinois Medical Services have agreed to settle a class action lawsuit alleging that website tracking technologies disclosed personally identifiable information (PII) to third parties without user knowledge or permission. The lawsuit, Doe v. Southern Illinois Healthcare Enterprises, Inc., was filed in Williamson County Circuit Court in Illinois.

A former Maryland hospital pharmacist has been indicted for an alleged cyber spying campaign that prosecutors said lasted more than eight years and involved unauthorized access to computers, theft of credentials, and surveillance of nearly 200 victims. Matthew Bathula, 41, of Clarksville, allegedly conducted the activity between July 2016 and September 2024 while employed as a pharmacy clinical specialist for a medical system identified in the indictment as Company A.