A significant data breach at MedSecure Health Systems has exposed the personal health information of approximately 4.2 million patients across 340 hospitals and clinics in North America.
The breach, discovered on August 10, 2026, involved unauthorized access to the organizations electronic health record (EHR) system over a period of approximately three weeks. Compromised data includes patient names, dates of birth, Social Security numbers, medical diagnoses, treatment records, and insurance information.
Timeline
- July 18, 2026 — Initial unauthorized access via compromised VPN credentials
- August 5, 2026 — Anomalous data exfiltration detected by SOC team
- August 10, 2026 — Breach confirmed and contained
- August 14, 2026 — Public disclosure and notification process begun
HHS Office for Civil Rights has opened an investigation. Affected patients are being offered 24 months of free credit monitoring and identity theft protection services.