Every horror movie runs on the same rule. The victim ignores the warning signs. The door creaks, the lights flicker, and they walk into the basement anyway.

Real breach stories follow that script. In the first quarter of this year, 200 large healthcare data breaches were reported, affecting 17.1 million individuals, 29.4% more than the same point last year. Many of the victims were small practices: eye clinics, OB-GYN offices, family medicine groups. Practices like yours. deepstrike

Here are five true stories from 2026, and the mistake behind each one.

1. The Clinic That Heard About Its Breach From the Criminals

Orem Eye Clinic, an optometry practice in Utah, suffered a ransomware attack in early 2026 affecting about 5,800 people. The breach first became public on January 26, when the NightSpire ransomware group claimed on the dark web that it had taken 1 terabyte of data from the clinic. rankiteo

The lesson: A terabyte of data does not leave your network in a minute. Your firewall should alert you when large amounts of data move out of your office, especially at night. If you find out about a breach from a leak site, you lost days you could have used to stop it.

2. The Leak Site That Showed Everything

Vernon & Waldrep OB-Gyn Associates in Dallas reported a breach affecting 16,876 Texas residents. The ransomware group Global Secret Group claimed it took 274 GB of data and published the full file tree. The folders covered patient records, clinical scans, bookkeeping, human resources, email, front office files and shared network drives. claimdepot

The lesson: One break-in reached every corner of the practice. Your front desk staff does not need access to the HR folder. Your billing team does not need clinical scans. Set folder permissions by job role, and keep patient records on a separate network segment from general office files. When an attacker gets one account, you want them stuck in one room.

3. Seventeen Days in the Dark

Family Medical Associates of Raleigh found suspicious activity on May 7, 2026. The investigation showed an intruder had accessed its systems on and off between April 18 and April 20. On June 3, the Genesis ransomware group claimed the attack, listing patient lists, clinical data, financial data and file server contents. claimdepot

The lesson: The intruder had a 17-day head start. Most small practices have no one reading security logs. If you don’t have staff for that, pay for 24/7 monitoring through endpoint detection software or a managed security provider. A two-hour response beats a two-week one.

4. The Notice That Took Six Months

Atlantic Digestive Specialists in New Hampshire spotted suspicious network activity in March 2026. Data may have been viewed or taken on March 16 and 17, according to a notice issued September 30. Exposed data may include Social Security numbers, driver’s license numbers, financial account information and medical history. beckersasc

The lesson: HIPAA gives you 60 days from discovery to notify patients. Investigations are slow, and you can’t wait for perfect answers before you start the clock. Before anything happens, write down the phone numbers for your cyber insurer, a breach attorney and a forensics firm. Practices that scramble to find these people after an attack lose weeks.

5. The Ghosts of Patients Past

Orthopedic surgeon Jeffrey Reuben, MD, in Texas reported a breach affecting 17,017 current and former patients. An unauthorized party accessed systems on April 18 and 19, 2026. Exposed data may include Social Security numbers, driver’s license numbers, government ID numbers and financial information. beckersasc

The lesson: Notice the words “former patients.” Every record you keep is a record you can lose. Set a retention schedule and purge what you no longer need. And if your intake form asks for a Social Security number, ask yourself why. If you can’t name a billing or legal reason, stop collecting it.

The Monster That Shows Up After the Breach

The attack is only the first scare. The federal investigation comes next.

On April 23, 2026, the HHS Office for Civil Rights announced settlements with four organizations after separate ransomware investigations. The cases affected more than 427,000 patients and totaled over $1 million. OCR found the same core problem in all four: an inadequate risk analysis. nixonpeabodysidley

One of them, Assured Imaging, failed to do an accurate and thorough risk analysis and failed to notify affected individuals on time. It paid $375,000 to OCR on top of corrective actions. physicianspractice

OCR will ask for your risk analysis first. If you can’t produce a written, dated one, you have a second problem on top of the breach.

Your Halloween Checklist

Get these done before October 31:

• Update your risk analysis. Put it in writing, date it, and review it at least once a year or after any major change, like a new EHR or office move.
• Turn on multi-factor authentication for email, your EHR and any remote access. Aim for 100% of accounts, including the doctor’s.
• Follow the 3-2-1 backup rule: three copies, two types of storage, one copy offline. Test a full restore every 90 days.
• Lock down shared folders by role. Review who has access every quarter, and remove former staff the day they leave.
• Run a phishing test every month. Most break-ins start with one click on one email.
• Purge old data you no longer need to keep.
• Write a one-page incident plan with names and phone numbers. Tape it somewhere other than the computer that might be encrypted.

None of the practices above planned to end up on a leak site. Each one had a door left open. Walk your office this week and check yours.

---

Sources: Rankiteo / Orem Eye Clinic, ClaimDepot / Vernon & Waldrep, ClaimDepot / Family Medical Associates of Raleigh, Becker’s / Atlantic Digestive Specialists, Becker’s / Jeffrey Reuben MD, Nixon Peabody / OCR settlements, Sidley / risk analysis, Physicians Practice / Assured Imaging, DeepStrike / Q1 2026 stats