Three healthcare breach disclosures landed together, and a senior living operator with facilities across six states is the one still counting. Liberty Healthcare Group spotted suspicious activity on August 7, 2026, isolated the affected systems and brought in outside responders. Unauthorized access is confirmed. The number of residents involved is not.
Working through a file review
Liberty runs senior living communities, nursing homes and rehabilitation facilities in North Carolina, South Carolina, Virginia, Tennessee, Louisiana and Florida. Names, addresses, birth dates, medical information and insurance details are the categories it expects to find. The incident sits on the HHS Office for Civil Rights portal at the 501-individual threshold for now. Long-term care is a slow-review environment: paper charts, scanned records and outside referrals must all be reconciled before a count is defensible.
An Oregon practice hit twice
A Hood River dental provider reported two separate events to the same patient population, totaling more than 31,000 people. Both involved comparable data categories, including names, birth dates, payment card numbers, Social Security numbers, medical record numbers and diagnoses. Disclosing twice for one patient base means the practice had to reconstruct which record went where in each window.
A seven day window in Ohio
Keep Smiling Dental Group in Beavercreek, Ohio, traced an intruder to its network from August 29 to September 5, 2026, after a disruption surfaced September 7. Files were accessed or acquired. Dental records including X-rays, treatment plans and clinical notes were in scope, along with billing data, and a subset of patients lost Social Security numbers. The practice added server-side hardening and anti-phishing training, and has published no count.
All three fit a pattern small providers struggle with: detection at the network edge, months of document review, and a notice issued before anyone can say how many records left.
