Three patient-facing organizations are mailing breach notices after intrusions earlier this year exposed personal and medical information, with the largest disclosure covering 17,017 patients of a Texas orthopedic surgeon.
An unauthorized party reached patient systems at Dr. Jeffrey David Reuben’s Houston-area practice between April 18 and April 19, 2026, according to the surgeon, who also works at medical centers in Bellaire. Investigators wrapping up in mid-July confirmed the theft of names, Social Security numbers, government identification numbers, and financial details. The practice is providing affected patients with 12 months of identity protection services.
Well Child, which runs school health programs for districts in Tennessee and Mississippi, caught the intrusion on June 1, 2026, and quickly took servers offline. Four days later its investigators confirmed files had been copied from a temporary storage server. Those records combined student names with screening histories, developmental assessment results, provider names, and billing codes, drawn from vision screening reports, student lists, and PEDS evaluation documents. A small subset of the files also contained Social Security numbers, and the provider has told federal regulators to expect a final victim count above 500.
A New Jersey eye surgery practice with six locations detected suspicious network traffic in early June 2026 and isolated affected systems. Horizon Eye Care Laser & Eye Surgery Center later confirmed that names, demographic details, treatment information, and health insurance data were compromised, reporting a placeholder figure of at least 501 affected individuals to the Office for Civil Rights.
None of the three organizations reported evidence of misuse, and all said they had hired third-party cybersecurity experts to assist their investigations.
