All About Women’s Care, an obstetrics and gynecology practice based in Englewood, Colorado, has notified approximately 12,000 patients that their personal and health information was compromised in a data breach involving a compromised employee VPN account.
The practice discovered suspicious activity involving an employee VPN account and engaged third-party cybersecurity experts, who confirmed that an unauthorized actor obtained VPN credentials and accessed the network. Files were exfiltrated in the attack, and a review completed on June 5, 2026, confirmed the exposed data included names, Social Security numbers, driver’s license numbers, clinical and treatment information, lab results, prescription data, and medical images.
Separately, Mid-South Pulmonary Sleep Specialists in Memphis, Tennessee, began notifying patients about a cybersecurity incident first detected on November 2, 2025. The Anubis ransomware group claimed responsibility and posted stolen data on its leak site. The review, completed May 18, 2026, confirmed exposure of patient data including medical histories, diagnoses, insurance details, and financial account information.
Both practices are reviewing security policies and working with cybersecurity professionals to prevent future incidents following the ransomware and credential theft attacks.
