A health IT consulting firm in New York spent nearly three months with an intruder inside its network before anyone noticed, and the files taken held clinical records for 49,467 patients.
The first sign of trouble at Cognitive Health Technologies came on April 27, 2026, when staff saw unusual activity on the network. Outside forensics specialists traced the intrusion back to February 5 and found it ran uninterrupted until April 28, a window of roughly twelve weeks in which someone pulled files and folders out of the environment.
Nearly 50,000 people had entries in those directories, spanning names, dates of birth, insurance information, medical histories and treatment notes. The company said no misuse of the data has surfaced, and that it has since reworked its security policies and layered on additional safeguards.
The pattern matters more than the count. Firms that sit between hospitals and their software hold the same charts as the hospitals do, but detection often lags because nobody watches their perimeter the way a health system watches its own.
HIPAA requires business associates to notify covered entities without unreasonable delay and no later than 60 days after discovery. Cognitive Health reported the incident to the HHS Office for Civil Rights on October 8, 2026.
Provider organizations should pull the contract language on breach notification for every consulting and hosting vendor, and test whether the vendor can produce access logs spanning more than a single quarter. An intrusion that runs from February to May leaves evidence only in logs someone actually retained.
