AI Governance
Data Centers
Drones
Climate
Privacy
2026 Maine Senate
Bob Dylan
Last Update: 10/27/2026 at 6:00 AM EST
Public-Sector and Healthcare Data Breaches
Coverage from Shasta County, FOX 35 Orlando, and others
This subject concerns breaches and other security incidents affecting personal data held by public agencies, healthcare providers, and their technology or administrative vendors.
The incidents include unauthorized access to provider portals, compromised credentials, exposure of Medicaid and patient information, and the response measures that follow, such as investigations, containment, notifications, identity monitoring, and added security controls. A representative case involves Connecticut’s HUSKY Medicaid program, Gainwell Technologies, Hartford HealthCare, and the state Department of Social Services, where accessed information included names, claim identifiers, service dates, billing details, and insurance information.
Looking Back
329 Day Timeline
Sep 29 '25
Nov 24 '25
Jan 12 '26
Mar 9 '26
May 4 '26
Jun 22 '26
Aug 17 '26
All Articles36 articles
Important
Shasta County, California, discovered in February 2026 that a public records portal posting exposed unredacted PHI and began notification and OCR reporting steps.
7/21/2026 • Data Breaches & Exposure Events • General
Crystal Lawson allegedly retained access to Florida DJJ's CCIS after termination, then leaked active warrant and case information to a drug trafficking organization, leading to 114 felony charges.
6/19/2026 • Data Breaches & Exposure Events • General
Connecticut DSS and Gainwell disclosed March 2026 unauthorized access to the HUSKY provider portal that used compromised Hartford HealthCare credentials and impacted about 22,500 people.
6/9/2026 • Data Breaches & Exposure Events • General
On March 4, compromised Hartford HealthCare credentials enabled a hacker to access the Connecticut Medicaid provider portal, affecting about 22,500 patients, with notifications mailed starting May 22.
5/22/2026 • Data Breaches & Exposure Events • General
Connecticut DSS announced May 22 postal notifications after a March 4 HUSKY provider-portal breach exposed personal information for about 22,500 enrollees.
5/22/2026 • Data Breaches & Exposure Events • General
Who: DOGE staff; What: unauthorized access and sharing of SSA records; When: over the past year prior to disclosure; Where: United States federal agencies; Why: to match records with state voter rolls for partisan aims.
3/2/2026 • Personal Data & Identity • General
Oklahoma health officials investigated fraudulent Medicaid enrollments in an alleged scheme exploiting an out-of-state data breach, while the attorney general launched an independent inquiry.
7/21/2026 • Data Breaches & Exposure Events • General
D.C. Public Schools warned families after an unauthorized third party may have accessed student information in a Summer Learning registration application in Washington, D.C.
7/30/2026 • Data Breaches & Exposure Events • General
HISA emailed portal users Friday about password changes beginning Monday, August 24, as an investigation continued into unauthorized access to confidential horse health information.
8/21/2026 • Data Breaches & Exposure Events • General
Fresno County Department of Social Services disclosed Thursday that a former employee exposed personal information belonging to 1,114 clients in Fresno, California.
7/31/2026 • Data Breaches & Exposure Events • General
DC Public Schools notified Washington, DC families after a Summer Learning registration application potentially exposed student and household information to an unauthorized third party.
7/30/2026 • Data Breaches & Exposure Events • General
District of Columbia Public Schools is investigating a potential breach of its Summer Learning registration application in Washington, DC, after an unauthorized party may have accessed student and family information.
7/30/2026 • Data Breaches & Exposure Events • General
Washington State DSHS notified thousands in Olympia after a March 2026 internal investigation found former employee insider misuse of client records in an internal database.
6/30/2026 • Data Breaches & Exposure Events • General
Whistleblower alleges former SSA contractor stored personal data on a thumb drive in the United States and planned transfer to a private employer; SSA IG and GAO investigations underway.
3/12/2026 • Cybersecurity (Privacy-Relevant) • General
Maximus US Services Inc. disclosed in 2026 that a breach of Nebraska's Provider Data Management System may have exposed provider names, birth dates, and Social Security numbers.
7/30/2026 • Data Breaches & Exposure Events • General
Entyre Care Massachusetts Inc. disclosed a March 2026 data breach involving publicly accessible files containing Medicaid IDs and medical records, discovered on May 12, 2026.
7/15/2026 • Data Breaches & Exposure Events • General
DHS is investigating a cyberattack on HSIN after reporting between late May and early June, with DHS reporting unclassified impact and no classified-system compromise.
7/1/2026 • Cybersecurity (Privacy-Relevant) • General
Interesting
DHS began investigating a data breach in a U.S. information-sharing network after suspected intrusion activity starting in late May or early June.
7/7/2026 • Cybersecurity (Privacy-Relevant) • General
Washington DSHS notified affected individuals in 2024 or later about a March data breach involving unauthorized access by a former employee.
7/7/2026 • Data Breaches & Exposure Events • General
DHS investigated a suspected cyber breach in a government information-sharing network starting between late May and early June in the USA.
7/7/2026 • Data Breaches & Exposure Events • General
Washington Department of Social and Health Services said a terminated employee accessed client personal data in March, exposing names, dates of birth, and Social Security numbers while showing no evidence of specific diagnoses.
7/2/2026 • Data Breaches & Exposure Events • General
Washington DSHS discovered in March that a terminated employee accessed 8,600 client records for non-work reasons, exposing SSNs and other PII.
7/2/2026 • Data Breaches & Exposure Events • General
Florida investigators charged former Department of Juvenile Justice probation officer Crystal Lawson in 2026 for alleged retained-access leaks from a state criminal case database.
6/20/2026 • Cybersecurity Tech (Privacy-Relevant) • General
Los Angeles County DPSS reported an employee-caused data exposure between 2024 and 2025 after filing a May 19, 2026 disclosure with California's Attorney General.
6/18/2026 • Data Breaches & Exposure Events • General
Hartford HealthCare employee credentials were used to breach Connecticut's HUSKY Medicaid provider portal in March 2026, affecting nearly 22,500 people.
5/28/2026 • Data Breaches & Exposure Events • General
Iowa Department of Health and Human Services disclosed a February 16 accidental state website posting that exposed Medicaid subscriber information for 6,717 individuals before prompt removal.
4/14/2026 • Data Breaches & Exposure Events • General
Iowa HHS notified 6,717 Medicaid members after inadvertent posting of limited subscriber identifiers and waiver details on the agency website in February 2024.
4/14/2026 • Data Breaches & Exposure Events • General
Iowa HHS reported on Monday that staff inadvertently posted a Feb. 16 Medicaid subscriber ID file on the department website, then removed the file and retrained staff.
4/14/2026 • Data Breaches & Exposure Events • General
Gaylord Specialty Healthcare and Gainwell Technologies report data breaches in December 2024 and July 2025 affecting patients in Connecticut and Medicaid recipients in Georgia due to unauthorized network access.
9/29/2025 • Data Breaches & Exposure Events • General
DHS investigated a cyberattack compromising HSIN and related SharePoint systems in late May to early June, while assessing possible document theft and personal data exposure.
7/1/2026 • Cybersecurity Tech (Privacy-Relevant) • General
Washington DSHS disclosed in 2026 that a March insider incident potentially exposed records of about 8,600 people and prompted direct notifications and law enforcement coordination.
6/30/2026 • Data Breaches & Exposure Events • General
Gainwell Technologies notified about 22,500 affected individuals in Connecticut after a March 2026 HUSKY provider portal breach using compromised Hartford HealthCare employee credentials.
6/5/2026 • Data Breaches & Exposure Events • General
Connecticut DSS and Gainwell Technologies reported in Hartford that unauthorized provider-portal access affected payment and service information for approximately 41,000 HUSKY Health members.
8/23/2026 • Data Breaches & Exposure Events • General
Connecticut's Department of Social Services and Gainwell Technologies notified approximately 41,000 HUSKY Medicaid members after unauthorized access to a provider reimbursement account exposed claims and payment information.
8/22/2026 • Data Breaches & Exposure Events • General
Connecticut officials said Gainwell Technologies detected a June 25, 2026 provider-portal breach exposing claims and payment information for approximately 41,000 HUSKY Health members in Connecticut.
8/21/2026 • Data Breaches & Exposure Events • General
Federman & Sherwood announced an active investigation of an Iowa Department of Health and Human Services data breach reported to the U.S. Department of Health and Human Services.
4/28/2026 • Data Breaches & Exposure Events • General