ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Organization

SEC

4 mentions in 7 days · 9 in 30 days · 10 total · first seen · last

Search everything

Timeline

AdaptHealth confirms 4.1 million people exposed in July cyberattack

AdaptHealth confirmed a ShinyHunters-attributed cyberattack exposed data of 4.1 million patients via a compromised third-party contractor account.

Healthcare company AdaptHealth confirmed 4,115,802 individuals were exposed in an intrusion first disclosed in an SEC filing on July 2, 2026, with the compromise beginning June 5. Attackers used social engineering to compromise a privileged third-party contractor account, accessed cloud-based patient management, document storage and EHR portals, and exfiltrated names, contact details, demographic, insurance and health information before a June 15 ransom demand. The attack was attributed to the ShinyHunters group, though the company no longer appears on the gang's extortion portal. Impacted individuals are being offered 12 months of free credit monitoring and identity protection.

BleepingComputerupdated · 5d agofirst · 6d agoData breach 2 sources1

Electronic health record company says customer data stolen in breach

Veradigm disclosed that attackers used stolen vendor credentials via an API to steal patient data including Social Security numbers, as the Gentlemen ransomware gang claims 3.5 million patients' records.

Electronic health records company Veradigm filed an 8-K with the SEC stating that an unauthorized party obtained credentials from a vendor's environment and used them to access a Veradigm API, downloading patients' personal data including Social Security numbers; no clinical or medical data was involved. The Gentlemen ransomware gang added Veradigm to its leak site, claiming theft of 3.5 million patients' health records. Access was limited to the specific API interface, with no operational disruption. Veradigm was previously hit by SamSam ransomware in 2019 and disclosed a December 2024 breach affecting 2,672,036 people.

The Recordupdated · 5d agofirst · 6d agoData breach in the wild 4 sources

Veradigm Confirms Patient Data Exposed in Third-Party Data Breach

Veradigm disclosed a third-party vendor breach exposing patient data including Social Security numbers via stolen vendor API credentials.

Veradigm filed an 8-K with the SEC on September 8, 2026, disclosing that attackers used credentials stolen from a third-party vendor to access a specific vendor-facing API and download patient personal data, including Social Security numbers for some individuals. No clinical or medical information was compromised, and Veradigm's internal infrastructure was not breached directly. The company activated incident response, notified law enforcement, and is offering credit monitoring to affected individuals.

Cyber Security Newsupdated · 5d agofirst · 6d agoData breach in the wild 4 sources

Veradigm warns of patient data breach after ransomware gang claims attack

Healthcare vendor Veradigm disclosed a patient data breach via a third-party vendor's credentials, which the Gentlemen ransomware gang claims involved 3.5 million records.

Veradigm, formerly Allscripts, told the SEC that an attacker used compromised credentials from a third-party vendor to access a customer-service API and copy patient data, including personal details and Social Security numbers, without touching clinical data or the broader network. The Gentlemen ransomware group listed Veradigm on its leak site claiming 3.5 million patient records and threatened to publish the data by September 11 unless ransom negotiations start. The gang, active since mid-2025, runs double extortion across Windows, Linux, NAS, BSD and ESXi, lists 800+ victims in 86 countries, and has been linked to a SystemBC proxy botnet and the GentleKiller EDR killer. Veradigm is notifying affected individuals, offering credit monitoring, and says it does not expect a material business impact.

BleepingComputerupdated · 5d agofirst · 6d agoData breach 4 sources

Boston Scientific left nursing its bottom line after cyberattack

Boston Scientific says its August 25 network intrusion will materially hit third-quarter and full-year sales and earnings, likely missing guidance.

Boston Scientific detected unauthorized activity on its network on August 25 and took systems offline, disrupting order processing and shipping operations worldwide. In an SEC filing, the medical device maker warned of a material impact on Q3 and full-year results, making it unlikely to meet the net sales growth and adjusted EPS guidance issued in July. Its distribution network has been substantially restored, sterilization facilities are operational, manufacturing resumed at most sites, and an interruption affecting cardiac device remote-monitoring activations was resolved. The company has not revealed the attack vector, whether ransomware was involved, or whether data was stolen; no ransomware group has claimed responsibility and the investigation continues.

The Register · Security · 7d agoData breach

Grindr Settles UK Data Privacy Claims for £26m

Grindr will pay £26m ($35.2m) to settle UK group claims alleging unlawful sharing of sensitive data, including HIV status, before 2020, without admitting liability.

The settlement, reached on September 2 and disclosed to the US SEC, covers roughly 12,000 claimants represented by Austen Hays over the free app's 2016–2020 data practices when Grindr was owned by Chinese conglomerate Kunlun. Grindr will pay £13m by December 31, 2026 and £13m by March 31, 2027, and continues to dispute the allegations; the agreement contains no admission of liability. The claims concerned sharing HIV status, PrEP use, ethnicity, and sexual orientation data with analytics providers Apptimize and Localytics without adequate consent. Norway's data protection authority fined Grindr €6.5m in 2021, and the UK ICO reprimanded the company in July 2022.

Infosecurity Magazine · 7d agoPolicy & legal

Nutex Health Says Patient Data Stolen, Hackers Threaten Leak

The Gentlemen ransomware gang claims breach of US healthcare provider Nutex Health, exfiltrating patient and employee data and threatening publication.

Nutex Health disclosed in an SEC 8-K filing that an unauthorized third party accessed and exfiltrated patient, employee, credentialed provider, business, and financial data from company servers, and threatened to publish it. The Gentlemen ransomware group listed Nutex on its leak site; a class action was filed August 27 and Edelson Lechtzin LLP is separately investigating. Nutex operates over 27 facilities in 12 states and served nearly 100,000 patients in the first half of 2026, with no material operational impact identified so far.

Infosecurity Magazine · 13d agoRansomware

Healthcare facilities operator Nutex says patient, employee data stolen in August incident

The Gentlemen ransomware gang claims the theft of patient and employee data from healthcare operator Nutex Health, which disclosed the extortion in SEC filings.

Nutex Health said in an 8-K filing that intruders broke into its servers and exfiltrated patient, employee, provider and confidential financial data, and that it is being extorted with threats to publish the information. A Texas class action was filed after the company's August 24 disclosure, and Nutex cannot yet estimate the incident's impact. The Gentlemen ransomware-as-a-service gang, active since September 2025 and believed Russia-based, listed Nutex on its leak site; Dragos ranked it third among groups attacking industrial organizations in Q2 2026 with 125 claimed attacks.

The Record · 14d agoRansomware

Medical device firm Boston Scientific says cyberattack has disrupted shipment processes

Boston Scientific says a cyberattack disrupted shipment and operating systems, forcing engagement of an incident response firm with no restoration timeline.

Medical device manufacturer Boston Scientific disclosed a cybersecurity incident discovered Tuesday that impacted access to operating systems and business applications, including processing and shipping customer orders. The company filed documents with the SEC, hired a cybersecurity firm, and told investors full restoration may take weeks. No group has claimed responsibility and it is unclear whether ransomware is involved. The company reported $5.4 billion in net sales in Q2 2026 and produces pacemakers and stents.

The Record · 20d agoData breach

Four corporate investigation mistakes organizations make under pressure

BlackBerry security executive outlines four investigation mistakes, warning poor chain of custody has cost firms over $2 billion in SEC penalties.

In a Help Net Security video, BlackBerry VP and Chief Security Advisor Christine Gadsby explains how early decisions in corporate investigations—granting access, informal conversations and undocumented choices—damage chain of custody, privilege and regulatory outcomes. She cites more than $2 billion in SEC penalties across over 100 financial firms since 2021 tied to missing records. Her guidance includes naming an incident commander, using communication channels with audit trails, verifying participants, and documenting decisions in real time.

Help Net Security · Aug 13, 2026Industry

Appears with

threat actor The Gentlemen 4vendor Veradigm 3victim Boston Scientific 2victim Veradigm 2threat actor ShinyHunters 2victim Nutex Health 2organization Nutex Health 2vendor Boston Scientific 2organization Apptimize 1organization Edelson Lechtzin LLP 1organization AdaptHealth 1organization ESET 1organization Gambit Security 1organization HHS 1organization CNBC 1organization Check Point 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.