Cognitive Health Technologies Data Breach Affects 49,500 Individuals
Data breaches have been announced by Cognitive Health Technologies in New York, City Ambulance Service in Texas, Baraga County Memorial Hospital in Michigan, The Speech Clinic in Georgia, and Innovative Alternatives in Texas.
Cognitive Health Technologies, New York
Cognitive Health Technologies LLC, a New York-based healthcare technology and IT consulting company, has disclosed a data security incident involving the protected health information of 49,467 individuals. According to its substitute data breach notice, suspicious network activity was identified on April 27, 2026. A forensic investigation was initiated to determine the nature and scope of the activity, which confirmed that its network had been accessed by an unauthorized third party between February 5, 2026, and April 28, 2026. During that time, there was unauthorized access and acquisition of files and folders containing protected health information.
The data review confirmed that the information compromised in the incident included names, dates of birth, health insurance information, medical histories, and treatment information. While patient data was compromised in the incident, no misuse of that information has been identified. Cognitive Health Technologies said it has reviewed its security policies and has implemented additional measures to protect against similar incidents in the future.
Avail of a Free 30-Minute
Cybersecurity Consultation
with Blue Team Alpha
Review your security program, get advice on a specific cybersecurity concern, identify risk-reduction priorities, or take the first step toward your annual HIPAA Security Risk Assessment.
Learn More About This Offer
Viking Enterprises (City Ambulance Service), Texas
Viking Enterprises, doing business as City Ambulance Service in Spring, Texas, has notified the HHS Office for Civil Rights about a hacking incident affecting 14,324 individuals. The breach was reported to OCR on August 31, 2026, as an email-related incident. Little information has been released about the incident, although based on the report submitted to the Texas Attorney General, the compromised data includes names, addresses, dates of birth, medical information, health insurance information, and Social Security numbers.
The Qilin ransomware and data theft/extortion group claimed responsibility for the attack and maintains that sensitive data was stolen. It is unclear if ransomware was used in the attack. The July 19, 2026, listing on its dark web data leak site states that 14 GB of data was exfiltrated, and the stolen data has been published. The HIPAA Journal has not downloaded any of the data, so it cannot verify the claim; however, the screenshots uploaded as proof of compromise include some patient data.
Baraga County Memorial Hospital, Michigan
Baraga County Memorial Hospital in L’Anse, Michigan, has reported a data breach to the HHS’ Office for Civil Rights that involved unauthorized access to systems containing the protected health information of patients. At the time of publication, the number of affected individuals has yet to be determined. The breach has been reported using a placeholder figure of at least 501 affected individuals.
The hospital has not yet disclosed details of the incident or the information involved, other than the report to OCR that states this was a hacking/IT incident. A cybercriminal group claimed responsibility for the incident on July 4, 2026. The Wallstreet ransomware group added Baraga County Memorial Hospital to its dark web data leak site and claims to have exfiltrated data in the attack. The group leaked the stolen data when the ransom was not paid.
Innovative Alternatives, Texas
Innovative Alternatives, Inc., a Houston, Texas-based nonprofit mental health and counselling service provider, has disclosed a data security incident involving the personal and protected health information of approximately 1,500 current and former clients, employees, and donors. On August 2, 2026, Innovative Alternatives learned that a criminal cyber actor had accessed its network and used ransomware to encrypt files. Third-party cybersecurity and digital forensics experts were engaged to investigate the incident, and it was confirmed that data was accessed and may have been acquired. The electronic medical record system was not involved.
The data review confirmed that the compromised information included names, contact information, clinical counselling notes, and, for employees, contact and employment information. Innovative Alternatives has changed all system and user passwords, conducted additional security scans, and worked with third-party cybersecurity experts to strengthen its security measures to reduce the risk of similar incidents in the future. Notification letters were mailed to the affected individuals on October 2, 2026.
The Speech Clinic, Georgia
The Speech Clinic, a Waycross, Georgia-based speech-language pathology, occupational therapy, and physical therapy service provider, has experienced a data security incident. On August 10, 2026, the practice began experiencing difficulties accessing a computer at its Waycross location. The forensic investigation confirmed on August 17, 2026, that the computer had been remotely accessed by an unauthorized third party, as well as an older server containing pre-2017 patient records of 2,168 patients.
The forensic investigation could not confirm whether patient data was accessed, but unauthorized access could not be ruled out. For some patients, only their name was exposed, while others had a combination of name, date of birth, Social Security number, diagnosis, and other medical information.
