Email Hack Affects at Least 24 Cancer Care Practices

At least two dozen cancer care centers and oncology practices in 12 states are reporting to federal regulators that nearly 123,000 patients were affected by a 2024 email phishing breach involving its parent organization, Integrated Oncology Network, which is owned by Cardinal Health.

See Also: On Demand | From Patch to Prevention: Modernizing Remediation Across Hybrid Environments

As of Wednesday, at least 24 HIPAA-covered organizations are listed on the U.S. Department of Health and Human Services’ Office for Civil Rights’ HIPAA Breach Reporting Tool website each reporting on June 27 email hacking breaches involving the ION phishing incident.

ION describes its network of oncology practices as part of a larger oncology alliance – Navista, which is owned by Cardinal Health, a multinational healthcare services firm, leading distributor of pharmaceutical products and a manufacturer of medical and surgical supplies.

Navista did not immediately respond to Information Security Media Group’s request for comment on whether any additional oncology practices in the wider alliance were affected by the ION phishing incident.

Breach Details

ION in a breach notice posted on its website said that on May 9, 2025, the organization concluded an investigation into a 2024 email phishing incident that resulted in unauthorized access to patient information “in a small number” of email and SharePoint accounts.

The investigation found that unauthorized parties accessed the email and SharePoint accounts between Dec. 13 and Dec. 16, 2024. “Although the likely purpose of the unauthorized access was to perpetuate an email phishing scheme, certain emails and SharePoint files were accessed by the unauthorized parties,” ION said.

A review of the affected emails, attachments and SharePoint files determined that they contained patient information, potentially including names, addresses, dates of birth, financial account information, diagnosis, lab results, medication, treatment information, health insurance and claims information, provider names and/or dates of treatment. “For a small number of individuals, the incident could have involved their Social Security numbers. To date, there is no evidence that your specific information has been misused,” ION said.

ION said that on June 13, it provided notifications to oncology physician practices that have patients whose information may have been involved in the incident.

The HHS OCR website shows that ION practices affected by the phishing incident include seven organizations in California: Orange County Radiation Oncology Medical Group, Mojave Radiation Oncology Medical Group, Radiation Oncology Network of Southern California, Golden State Radiation Oncology, and three California Cancer Associates for Research and Excellence practices, in San Diego, High Desert and Fresno.

In Texas, at least four ION practices reported breaches, including PET Imaging of The Woodlands, PET Imaging of Sugar Land, PET Imaging of Houston Medical Center and PET Imaging of Dallas Northeast.

In Florida, ION practices reporting breaches include Bardmoor Cancer Center and Lake City Cancer Care. In Alaska, ION practice reporting breaches include Fairbanks Urology and Denali Biomedical. At least two ION practices in Louisiana also reported breaches, including e+ Oncologics Louisiana and Acadiana Radiation Therapy.

Other entities also reporting ION related breaches include South Georgia Center for Cancer Care in Georgia; Rocky Mountain Oncology Care in Wyoming; PET Imaging of Tulsa Oklahoma; Southwest Urology in Ohio; PET Imaging of Northern Colorado. Tennessee-based ION also reported directly to HHS OCR as a business associate that its phishing breach affected 4,174 people.

So far, the largest single breach involving the ION incident was reported by Lake City Cancer Care in Florida as affecting 15,142. The smallest ION breach was reported by California Cancer Associates for Research and Excellence in San Diego, affecting 638 people.

Taking Action

As of Wednesday, the HHS OCR website shows 108 major email breaches posted so far in 2025, affecting more than 1.75 million individuals. Nearly a quarter of those reported email breaches appear to involve the ION phishing incident.

So far in 2025, the largest email phishing breach posted on the HHS OCR website was reported in March by Tennessee-based United Seating and Mobility, which does business as Numotion, and is a provider of wheelchairs and other mobility products. That incident affected 494,326 people and is also currently ranked as the 10th largest HIPAA breach posted on the HHS OCR website so far in 2025.

Experts said that in the age of AI-enabled tools, increasingly sophisticated social engineering schemes and other scams involving email phishing, business email compromise and related attacks, it’s critical that healthcare organizations and their vendors ratchet up efforts to avoid falling victim.

“Continuing to conduct internal phishing campaigns is important, including requiring ‘clickers’ to take training,” said Keith Fricke, partner at privacy and security consultancy tw-Security.

“Additionally, it is important to send very realistic phishing emails as part of those campaigns. Criminals lean on artificial intelligence to craft very realistic phishing messages; therefore, our internal phishing efforts need to keep pace with the realism,” he said.

Organizations should also continue to remind their workforces that software companies “will never send emails with links to sites to download security patches or include an attachment claiming to contain a security update,” he said.

Also, “workers, including upper management, need to be familiar with internal protocols for approving wire transfers and invoice payments of any amount. For notices of orders shipped, do not rely on email notifications – instead go to the website of the courier and enter the tracking number,” he said.

One top mistake many people make is trusting that the sender of an email actually was the one sending the message, he said. “Criminals seek to compromise email accounts to masquerade as the owner of the email, making phishing easier.”

But while important, training alone isn’t enough. “You need layers and a zero trust mentality,” said Jerry Tylman, head of the fraud red team at managed services firm Neovera. “Think beyond email filters to include behavioral monitoring and automated response. It’s also important to focus on reducing impact and spread, not just prevention,” he said.

Deepfakes and AI-detection tools are still developing, and the unfortunate truth is that many can be bypassed, he said. “It’s important to take a layered approach to cybersecurity. While these tools are essential to that layer, CISOs at healthcare organizations and other highly regulated industries need to test vendor claims with real-world AI-generated voice, text, behavior and document examples,” he said.

Another consideration for healthcare organizations is that phishing targets are typically busy administrators or clinical staff who are often distracted and moving quickly, Tylman said. “That’s the perfect storm for attackers.”

Healthcare sector organizations need to shift from a reactive to a proactive approach, he stressed. “Focus on automating defenses, using context-aware tools and planning for when – not if – something gets through,” he said. “Having a solid incident response plan is just as critical as blocking the attack.”