The largest of three newly reported healthcare breaches came from a pharmacy storefront, not a back office. Ridgeway Pharmacy Ltd, a mail-order and community operation in Victor, Montana, told regulators and customers that its third-party built website exposed the records of 258,920 people.
Ridgeway learned on August 21, 2026 that personal information was reachable through the site. Outside forensics confirmed the exposure stopped at the web tier: order names, mailing addresses, birth dates, prescriptions, clinical detail and plan information were all in play, and a smaller group also had payment cards caught up. The pharmacy has moved to a new platform, cut back administrative access and added monitoring. Credit protection is being offered.
Two smaller notices round out the batch. IMS Care Center, a physician-owned multi-specialty group in Phoenix, found suspicious mailbox activity in June 2026. The intrusion ran across June 17 and 18. By September 30 it had confirmed that names, addresses, Social Security numbers and medical records were exposed. Letters went out October 16 with a year of monitoring attached. The practice has added managed detection and response coverage and geo-restricted mailbox access.
Persona Dental in Sartell, Minnesota, reported 3,386 current and former patients after an intruder sat inside its network from April 28 to April 30, 2026. Diagnosis, treatment and insurance details were involved, with Social Security numbers for part of the group.
The pattern worth noting for compliance teams is structural. None of these were sophisticated campaigns against core records systems. A public website, an email tenant and a flat practice network each served as the door. Business associate agreements do not cover a vendor-built site unless someone writes them to.
