A US judge has certified four classes of Facebook users in a lawsuit alleging Meta Pixel collected sensitive health and prescription data from healthcare websites and apps.

Quest Diagnostics has disclosed a cyber breach involving its Quanum Lab Services Manager platform, which doctors and other clients use to order tests and access laboratory results. The medical testing company said it discovered unauthorized access on Wednesday and believes that certain patient records were likely accessed, although the exact number of affected people and the specific data exposed remain unknown.  In a regulatory filing on Thursday, Quest said it had launched cybersecurity incident-response procedures to contain the activity and investigate the breach. The company also notified federal law enforcement and engaged external cybersecurity specialists to support its response. Quest has not said whether the attackers obtained names, contact details, test results, insurance information, or other sensitive health data.  The incident is significant because the Quanum platform sits at the centre of clinical workflows for some healthcare providers. It allows authorised clients to place test orders and receive or review patient results, meaning a compromise could expose information that is both personal and medically sensitive. Quest said the breach has not materially disrupted its core operations or its ability to serve patients, but the company has paused access to the affected system while it investigates.  This is not the first time Quest Diagnostics has faced a major data-security incident. In 2016, the company said an online breach exposed lab results and contact information for about 34,000 people. In 2019, personal information belonging to roughly 11.9 million Quest patients was affected through a separate hack at American Medical Collection Agency, a billing collections provider. The latest case is notable because Quest has identified unauthorized access directly within one of its own systems rather than through a third-party vendor.  The breach comes amid a wider rise in cyberattacks affecting healthcare and other essential industries. Quest confirmed to The Associated Press that this incident was not related to the recently disclosed PHP vulnerabilities that have prompted urgent security patches across much of the internet. For patients and healthcare providers, the case highlights the need for strong access controls, rapid breach detection, and clear communication when medical data systems are targeted. Until Quest completes its investigation, affected individuals should remain alert for suspicious emails, calls, or messages that request personal or medical information.  

Healthcare devices lag in quantum readiness, putting patient data at risk and complicating migration to post-quantum cryptography.

Autonomous AI breaches Australia's Medicare statistics portal, prompting shift to adaptive threats alongside NZ health breach.

  A cyberattack on Polish healthcare software company Qbusoft has left patient records from its Medyc platform potentially in the hands of attackers, coming just weeks after a separate, larger breach hit another Polish medical software provider and rattled the country's entire health data infrastructure. The attacker exploited an SQL injection vulnerability in Medyc's application interface during late August, according to a breach notification published last week by the Addiction and Psychiatric Treatment Center in Inowrocław, one of the healthcare facilities running the platform. SQL injection is one of the oldest and best-documented attack techniques in security research, allowing an attacker to manipulate a web application into pulling data directly from its database. Despite decades of awareness about the flaw, it remains a recurring entry point in healthcare system compromises. Qbusoft confirmed on Friday that the attackers obtained names, national identification numbers, home addresses, phone numbers and email addresses. In Poland, the national identification number, called a PESEL, functions similarly to a Social Security number in the United States and is a standard credential for identity verification across government services, banking and healthcare. Its theft puts affected patients at real risk of identity fraud. The company said it had not confirmed the theft of clinical records. But the Inowrocław center told patients that Qbusoft found evidence the attacker ran scripts specifically targeting database tables containing medical information, making it "highly likely" that medical records were also pulled. The data in scope for that facility included hospital treatment records and discharge summaries from patients treated at its Day Treatment Unit for Addiction Treatment between July 2024 and August 2026. The intrusion occurred on August 22-23 and went undetected until the night of September 8-9, a gap of more than two weeks. By that point, the attacker had already transferred an encrypted archive of the database outside Qbusoft's systems. Some fields, including names and PESEL numbers, had been encrypted in the database. Qbusoft nonetheless advised the affected center to assume the attackers could decrypt that information without difficulty, given the specifics of how the protection was implemented. Qbusoft patched the vulnerability on the day the breach was detected, restricted database access permissions, rotated passwords and technical credentials, and introduced additional monitoring. The company has not publicly commented on the incident through any official statement. That silence drew a sharp response from Digital Affairs Minister Krzysztof Gawkowski, who said the Central Bureau for Combating Cybercrime had opened an investigation and criticized Qbusoft for failing to notify CERT Polska or the national incident response team for the healthcare sector before authorities reached out. "Hiding attacks by companies is the biggest mistake, as it always puts citizens at risk," Gawkowski said. Poland's data protection authority separately announced that its president had ordered a formal audit of Qbusoft. Medyc, which has operated as a cloud-based platform since 2014, is used across Polish medical practices and clinics for electronic medical records, patient scheduling, electronic prescriptions, referrals, sick notes, telemedicine and administrative billing. In a public notice, the company warned that its infrastructure had faced repeated attack attempts since the incident and that users might see temporary slowdowns or restricted access to certain modules. The Same Attacker? Polish cybersecurity publication Zaufana Trzecia Strona reported that a person or group using the alias "fingerprint" contacted the outlet claiming responsibility for the Medyc attack. The publication had previously linked that alias to the MyDr breach, a separate incident involving another Polish healthcare software vendor. Polish broadcaster RMF FM also reported that the same attackers behind MyDr were likely responsible for the Medyc intrusion, though Polish authorities have not formally attributed the attack to any individual or group. The alleged attacker claimed to have obtained records on 5 million patients and 8 million private photographs, some of which Zaufana Trzecia Strona said may depict patients in sensitive medical settings. Neither figure has been independently confirmed, and the stolen data has not been made public. The actor reportedly framed the operations as an effort to expose weak security rather than profit from the data. The MyDr breach, confirmed in August, potentially affected close to 19 million people across more than 12,000 healthcare facilities, involving over 2 terabytes of stolen data including names, PESEL numbers, prescription histories, diagnoses and appointment records. Poland has roughly 36.5 million residents, meaning the MyDr incident alone touched the records of nearly half the country's population. The Inowrocław treatment center caught up in the Medyc breach was also among the organizations affected by MyDr. Gawkowski said Polish authorities had observed a surge in criminal activity targeting healthcare organizations in recent weeks and were preparing new regulations in response, including mandatory security certification for healthcare technology companies and tighter controls on how private vendors handle medical data. Poland recorded a 144 percent year-on-year rise in reported cybersecurity incidents in 2025. The consecutive breaches of Medyc and MyDr, both software vendors connecting thousands of clinics to national health infrastructure, have made clear that the weakest link in Poland's health data chain is not the government platform but the private companies sitting in front of it.

After an OpenAI agent was caught accessing Australia's Medicare health database, the Senate demanded answers from the CEOs behind the tech. Both Sam Altman and Dario Amodei are skipping the October 1 hearing, with their companies citing short notice, leaving Australian lawmakers demanding they "front up." https://qz.com/openai-anthropic-australia-senate-ai-hearing-092826

NCCS sent a hereditary breast and ovarian cancer event invite with 467 addresses in CC. Names and employers were visible; MOH and PDPC are involved. What to do.

Telehealth companies have been increasingly criticized for exposing customers' medical data, engaging in deceptive business practices, and bypassing proper medical consultations. According to a recent Federal Trade Commission (FTC) lawsuit against Hims & Hers, these companies often disclose health information to platforms like Meta and Google without user consent. The FTC alleges that Hims & Hers automatically enrolled customers in recurring prescriptions with minimal opportunity to review treatment recommendations, a practice documented across the industry. A study by Yale University found that less than a third of telehealth companies selling GLP-1 drugs required real-time video or audio consultations with physicians, with many prescriptions approved within minutes. The lack of proper medical oversight means patients often miss critical discussions about weight-loss goals, past efforts, and eating disorders, which GLP-1 drugs can exacerbate. Federal privacy laws like HIPAA generally do not apply to telehealth companies, creating a legal gap that allows these firms to share sensitive health data with advertisers. Privacy experts note that while the FTC has taken action against several companies, penalties are limited, and enforcement of state-level privacy laws remains weak. Experts recommend using ad blockers, private browsing, and carefully reading user agreements to protect personal data, though many argue the system places undue burden on consumers. The FTC's complaint against Hims & Hers claims the company misrepresented its platform as '100% online, private and secure,' while allegedly sharing data with third parties. Despite these issues, telehealth services continue to grow rapidly, driven by consumer demand for convenient access to medications for conditions like ADHD, sexual dysfunction, anxiety, and weight loss. The current regulatory environment leaves patients vulnerable, with limited recourse when their health information is mishandled. Experts call for stronger federal legislation to close the privacy gap and ensure telehealth companies adhere to ethical standards. Until then, consumers must navigate a complex landscape where their health data is often treated as a commodity rather than a protected asset.

California health publisher fined for sharing medical data with third parties despite user opt-outs.

California health publisher fined for sharing medical data with third parties despite user opt-outs.

Medical Datasets for Teaching R

Tumor boards are multidisciplinary teams of healthcare professionals that are working together to encompass the full spectrum of care around diagnosing, plan...

 Hospital Sisters Health System informed nearly 882,000 patients that a cyberattack in August 2023 resulted in a data breach that compromised their private and medical data.  Established in 1875, HSHS works with about 2,200 physicians and employs over…

The global incidence of infectious diseases has increased in recent years, posing a significant threat to human health. Hospitals typically serve as frontline institutions for detecting infectious…

ESMS Global Limited in GB reported a medical information services data breach associated with ransomware operations attributed to the threat actor anubis. The incident resulted in unauthorized access to sensitive medical data and potential exposure of impacted records. #UnitedKingdom