Data Breaches at Healthcare Organizations in Illinois and Texas Affect 600,000

Summary

Three US healthcare organizations—North Texas Behavioral Health Authority (285K victims), Southern Illinois Dermatology (160K), and Saint Anthony Hospital (146K)—disclosed data breaches between October 2025 and February 2025. The incidents exposed personal information including SSNs and health records; Southern Illinois Dermatology was claimed by the Insomnia ransomware group, while Saint Anthony Hospital had two compromised employee email accounts.

Full text

Three US healthcare organizations — two in Illinois and one in Texas — have disclosed data breaches affecting a total of nearly 600,000 individuals. The data breach tracker operated by the US Department of Health and Human Services (HHS) was updated this week to add three healthcare-related cybersecurity incidents impacting a significant number of people. The biggest breach was disclosed by the North Texas Behavioral Health Authority, affecting 285,000 individuals. The organization, which provides resources for mental health and substance abuse, revealed in March 2026 that it had detected a network intrusion in October 2025. An investigation showed that unauthorized individuals may have accessed and exfiltrated files containing personal information, including SSNs. The second healthcare organization for which the HHS disclosed the number of affected individuals this week is Southern Illinois Dermatology, with 160,000 victims. The Salem, Illinois-based skincare provider said in a data breach notice that it became aware of a cybersecurity incident in late November 2025. An investigation completed in early March showed that files storing personal information were compromised.Advertisement. Scroll to continue reading. The Insomnia ransomware group listed Southern Illinois Dermatology on its website in February, claiming to have stolen the information of 150,000 patients. The cybercriminals have leaked the data allegedly taken from the healthcare organization’s systems. The third significant data breach hit Saint Anthony Hospital, which told the HHS that an email security incident exposed the information of 146,000 people. The Chicago, Illinois-based hospital said two employee email accounts were compromised, exposing patients’ personal and health information. The intrusion occurred in February 2025. While it does not seem to be related, Saint Anthony Hospital was previously targeted by the LockBit ransomware group, which listed the organization on its leak website in January 2024. Related: Other Healthcare Security Incidents Related: Data Breach at Tennessee Hospital Affects 337,000 Related: Massachusetts Hospital Diverts Ambulances as Cyberattack Causes Disruption Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. More from Eduard Kovacs Next.js Creator Vercel HackedAnother DraftKings Hacker Sentenced to PrisonRecent Apache ActiveMQ Vulnerability Exploited in the WildZionSiphon Malware Targets ICS in Water FacilitiesOpenAI Widens Access to Cybersecurity Model After Anthropic’s Mythos RevealData Breach at Tennessee Hospital Affects 337,000Microsoft Paid Out $2.3 Million at Zero Day Quest 2026 Hacking ContestClaude Code, Gemini CLI, GitHub Copilot Agents Vulnerable to Prompt Injection via Comments Latest News Organizations Warned of Exploited Cisco, Kentico, Zimbra Vulnerabilities$290 Million Kelp DAO Crypto Heist Blamed on North KoreaSerial-to-IP Converter Flaws Expose OT and Healthcare Systems to HackingBritish Scattered Spider Hacker Pleads Guilty in the USHackers Abuse QEMU for Defense EvasionBluesky Disrupted by Sophisticated DDoS AttackSenate Extends Surveillance Powers Until April 30 After Chaotic Votes in HouseHalf of the 6 Million Internet-Facing FTP Servers Lack Encryption Trending Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: A Step-by-Step Approach to AI Governance April 28, 2026 With "Shadow AI" usage becoming prevalent in organizations, learn how to balance the need for rapid experimentation with the rigorous controls required for enterprise-grade deployment. Register Virtual Event: Threat Detection and Incident Response Summit May 20, 2026 Delve into big-picture strategies to reduce attack surfaces, improve patch management, conduct post-incident forensics, and tools and tricks needed in a modern organization. Register People on the MoveAnti-ransomware platform Halcyon has named Kirstjen Nielsen and Chris Inglis as Strategic Advisors.ThreatModeler has appointed Kevin Gallagher as Chief Executive Officer.Thomas Bain has been appointed Chief Marketing Officer at Silent Push.More People On The MoveExpert Insights Government Can’t Win the Cyber War Without the Private Sector Securing national resilience now depends on faster, deeper partnerships with the private sector. (Steve Durbin) The Hidden ROI of Visibility: Better Decisions, Better Behavior, Better Security Beyond monitoring and compliance, visibility acts as a powerful deterrent, shaping user behavior, improving collaboration, and enabling more accurate, data-driven security decisions. (Joshua Goldfarb) The New Rules of Engagement: Matching Agentic Attack Speed The cybersecurity response to AI-enabled nation-state threats cannot be incremental. It must be architectural. (Nadir Izrael) The Next Cybersecurity Crisis Isn’t Breaches—It’s Data You Can’t Trust Data integrity shouldn’t be seen only through the prism of a technical concern but also as a leadership issue. (Steve Durbin) Why Agentic AI Systems Need Better Governance – Lessons from OpenClaw Agentic AI platforms are shifting from passive recommendation tools to autonomous action-takers with real system access, (Etay Maor) Flipboard Reddit Whatsapp Whatsapp Email

Entities