Three U.S. Health Providers Report Patient-Data Breaches, Including Singing River Incident Affecting 53,888
Summary
Singing River reports unauthorized access to patient-data files affecting 53,888 people; Anubis claims the attack and 293 GB exfiltration. The article also details phishing-related and network breaches at two other healthcare providers.
Key points
- Singing River’s investigation found unauthorized access to certain computer systems from December 19–21, 2025; it later confirmed that files containing patient information were accessed.
- Exposed Singing River data included names combined with information such as Social Security numbers, medical details, financial information, and insurance data.
- The incident was reported to HHS as affecting 53,888 people. Anubis claimed responsibility and claimed to have exfiltrated 293 GB; the article says the group published sensitive data samples.
- Adams County Memorial Hospital reported a breach affecting 5,305 people after a phishing email led to unauthorized access to an employee’s email account; its electronic medical record system was not affected.
- Central Kansas Mental Health Center confirmed unauthorized network access and said files containing patient data were likely exfiltrated. Its review is ongoing, and the number affected is unknown.
Article Details
- Victim Organization
- Singing River Health System
- Victim Domain
- Not disclosed
- Incident Type
- Unauthorized access to computer systems from December 19 through December 21, 2025; Anubis claimed responsibility and alleged data exfiltration.
- Incident Date
- 2025-12-19
- Disclosure Date
- 2026-02-10
- Data Types Exposed
- Names
- Contact information
- Social Security numbers
- Driver’s license numbers
- Dates of birth
- Diagnostic and treatment information
- Medication information
- Dates of service
- Bank account information
- Health insurance information
- Provider names
- Internal patient identification numbers
- ID cards
- Intimate patient photographs
- Affected Records
- 53,888 individuals, as reported to the HHS Office for Civil Rights.
- Affected Data Size
- Anubis claimed to have exfiltrated 293 GB; this was not independently confirmed in the article.
- Operational Impact
- An unauthorized third party accessed certain computer systems and files containing patient information. No operational disruption was reported.
- Ransom Or Extortion
- Anubis claimed responsibility, posted samples it presented as stolen data, and released highly sensitive information to pressure the health system into paying. Whether the health system negotiated with the group is unknown.
- Claim Status
- confirmed