Orova Leak Claims to Expose Data of 150,000+ Cardiology Patients; Breach Unconfirmed
Summary
DataBreaches analyzed files attributed to an Orova attack on Cardiology Associates of Port Huron and found extensive patient and health information. The practice has not confirmed the breach, and the records’ authenticity is not fully verified.
Key points
- Orova claimed it breached Cardiology Associates of Port Huron on June 25, 2026, encrypted some servers, and exfiltrated data; the group reportedly planned to release the archive password.
- Researchers counted 150,380 patient records in a backup analysis and 145,846 in a separate spreadsheet review; these counts do not establish the number of unique patients.
- The reviewed files reportedly contained names, Social Security numbers, contact details, dates of birth, insurance identifiers, diagnoses, treatment codes, and medical records.
- The data tranche reportedly included more than 3,300 radiology images that could reveal patients’ names and dates of birth.
- DataBreaches said the material appeared authentic but could not independently verify that all records were real; the medical practice had not publicly confirmed or refuted the incident.
- The article says the practice had not publicly described steps to notify affected patients or prevent further exposure.
Article Details
- Victim Organization
- Cardiology Associates of Port Huron (CAPH)
- Incident Type
- Ransomware incident involving alleged encryption of some servers and claimed exfiltration of patient and internal data.
- Incident Date
- 2026-06-25
- Disclosure Date
- 2026-08-04
- Data Types Exposed
- Protected health information
- Patient names and contact details
- Social Security numbers
- Dates of birth and ages
- Medical record numbers
- Health insurance plan, policy, member, and claim information
- Diagnoses and procedure codes
- Radiology images
- Provider billing and payment records
- Affected Records
- Researchers identified 150,380 patient records in a backup analysis and 145,846 in a manual analysis; the total number of unique patients in the tranche could not be determined. Orova claimed 256,382 files.
- Affected Data Size
- Orova revised its claim to 496 GB, including a 400 GB backup.
- Operational Impact
- Orova’s spokesperson claimed some CAPH servers were encrypted, but said CAPH had backups and could recover. The article does not independently confirm operational disruption.
- Ransom Or Extortion
- Orova listed the data on its leak site and was about to leak the password to the password-protected archive. The article does not report a ransom demand or payment.
- Claim Status
- alleged