Hacks on 3 Specialty Medical Providers Affect Nearly 800,000

Recent hacks on a provider of sleep disorder diagnostic gear and services, a network of medical imaging facilities and a multi-disciplinary cancer care center have affected nearly 800,000 patients. The breaches are among the latest rash of cybercriminal attacks plaguing the healthcare sector.

See Also: On Demand | From Patch to Prevention: Modernizing Remediation Across Hybrid Environments

The three companies reporting the health data hacks to federal and state regulators are Compumedics USA, an Australian sleep disorder company with U.S. operations based in North Carolina; Mount Baker Imaging and its associated Northwest Radiologists, Inc., which are based in Washington State; and Highlands Oncology Group, an Arkansas-based cancer care provider.

Compumedics Hack

Compumedics reported its hacking incident to the U.S. Department of Health and Human Services on June 27 as affecting 318,150 patients of nearly a dozen healthcare practices the company provides diagnostic, research technologies and services for sleep disorders used in sleep study clinics.

Compumedics’ healthcare clients affected by the breach include Bermuda Sleep & Signature Services; Hope Healthcare; Bronson Healthcare Group; Chest Medicine Associates; Billings Clinic; Davis Medical Center; Norther Light AR Gould; Northern Light Eastern Maine Medical Center; Northern Light Sebasticook Valley Hospital, VCU Health System Authority; and Vitalcare Family Practice.

The company said that it initially identified a security incident on March 22 and immediately took steps to secure its systems and contain the issue. The investigation into the incident determined that an unauthorized party accessed certain Compumedics systems for over a month, between Feb. 15 and March 23, in which some files were viewed or copied.

Information potentially contained in the affected files include names, dates of birth, demographic information, medical record numbers, treatment and diagnosis information, dates of treatment, provider names, sleep study details and results. For a subset of individuals, the hack also affected Social Security numbers and health insurance information.

Compumedics did not immediately respond to Information Security Media Group’s request for additional details about the data breach.

Mount Baker Imaging/Northwest Radiologists Breach

Mount Baker Imaging/Northwest Radiologists reported its hacking incident to Washington State’s attorney general on July 10 as affecting 348,118 people. The medical imaging services provider in a breach statement said that on or about Jan. 25, 2025, the entity experienced “a network disruption” that affected certain systems.

The investigation into the incident determined that some information stored on Mount Baker Imaging/Northwest Radiologists’ network was subject to unauthorized access from Jan. 20 to Jan. 25.

Information potentially compromised in the incident includes name, address, telephone number, date of birth, email address, Social Security number, driver’s license, state identification card number, treatment or diagnosis information, provider name, medical record number, patient identification number, health insurance information and treatment cost information.

The medical imaging provider said it currently has no reason to believe that the affected information has been or will be misused as a result of the incident.

Mount Baker Imaging/Northwest Radiologists did not immediately respond to ISMG’s request for additional details about the incident, including whether attackers launched ransomware encryption on the entity’s IT systems or data.

Highlands Oncology Hack

Highlands Oncology reported on Aug. 1 to the state of Maine’s attorney general a cyberattack discovered on June 2 that rendered its data and IT systems “inaccessible,” affecting 113,575 people.

The access by hackers to Highlands Oncology’s systems appears to have lasted nearly six months.

“The forensic investigation determined that an unauthorized third-party accessed Highlands’ computer network at times between Jan. 21 and June 2, 2025, and encrypted some of its files,” Highlands Oncology said in a breach notice posted on its website.

The investigation also found that the third-party may have accessed and acquired files from Highlands’ systems during this period, the notice said.

Affected information varies among individuals but potentially includes name, date of birth, Social Security number, driver’s license, state identification number, passport number, credit and debit card number, financial account number, medical treatment information, medical record number, patient account number and health insurance policy information.

Highlands Oncology did not immediately respond to ISMG’s request for additional details about its hacking incident, including the ransomware gang claiming responsibility for the data encryption and theft, and whether the cancer center a paid an extortion demand.

Disturbing Trends

The attacks on Compumedics, Mount Baker Imaging/Northwest Radiologists and Highland Oncology are part of an ongoing, disturbing cyber trend in healthcare, some experts said.

Ransomware will continue to remain relentless in the years ahead, predicted Scott Weinberg, CEO of managed services firm Neovera.

“Healthcare remains one of the most lucrative targets due to its operational urgency and sensitive data. We’re seeing more data exfiltration and double extortion tactics. Ransom isn’t just about restoring access, it’s about preventing public data dumps,” he said.

In particular, hackers will continue to increase their targeting of specialized clinics and medical practices, he said. “Oncology, radiology, sleep clinics and rural providers typically have under-resourced IT and security teams, along with many vendors that they work with and depend on. That makes them ideal soft targets.”

Indeed, the unfortunate reality is that cyberattacks against healthcare organizations aren’t slowing down, and their impact is only becoming more severe, said former ransomware negotiator Jeff Wichman, who is currently director of incident response at security firm Semperis.

“We’ve seen major healthcare systems and smaller regional healthcare organizations fall victim to attacks over the past dozen months. The attacks are taking their toll and creating issues for staff and patients across the board,” he said.

A recent report by Semperis found that alongside government organizations, healthcare organizations took the longest to recover after an attack, and in healthcare alone, the rate of same-day recovery dropped by 28%, he said.

Semperis’ recent ransomware research also found that attackers are becoming increasingly aggressive, he said. “Not just in who they target, but how they push for ransoms,” he said.

For the healthcare sector specifically, beyond locking IT systems or destroying data, ransomware gangs now threaten to release private or proprietary information at least 62% of the time, file regulatory complaints against the entities and even make physical threats against executives and staff, he said.

“It all comes down to cyber resilience and recovery. Healthcare CISOs and security leaders need to shift their mindset to an ‘assume breach’ mentality,” he said.

“The reality is no system is 100% secure. What really matters is how quickly you can detect, respond to and recover from the incident,” Wichman said.

“Building resilience starts with protecting the most critical systems, such as identity systems, most frequently Active Directory, which is targeted in approximately 90% of ransomware cyberattacks,” he said.

Assuming that a breach occurred also means “staying alert,” he said. “If one part of a network is compromised, the chances are others could be too. Monitoring for unauthorized changes and having real-time visibility into accounts and systems can make a huge difference. And having a recovery and response plan in place to get systems back online fast.”

Weinberg also urges healthcare entities’ scrutiny of their third-party vendors to stretch way beyond questionnaires. “Business associate agreements need more diligence. CISOs should require evidence of controls – multifactor authentication, logging, EDR – audit rights and proof of breach notification timelines,” he said.

Also, network segmentation, least-privilege access, offline backups and rapid incident response playbooks should be in place now – not after the fact, he said.

“Increase phishing defenses. Many breaches still begin with credential harvesting. Implement phishing-resistant MFA, improve email gateway filtering and continually test staff through simulations,” he said.