Loading story…
San Jose officials notified current and former city employees that a USB drive was lost on Jan. 9 and may have contained sensitive employee data, including Social Security numbers; the city has not disclosed how many individuals were affected. Separately, Conduent Business Services reported a large-scale compromise in which attackers allegedly accessed its network from Oct. 21, 2024 to Jan. 13, 2025 and exfiltrated files containing personal and medical data; multiple state-level notices and alerts cited impacts ranging from 10.5 million individuals (Oregon DOJ alert) to 4 million residents (Texas), with Conduent stating it has not seen evidence of misuse or public posting to date.
In another incident, Managed Care Advisors / Sedgwick Government Solutions disclosed a ransomware event affecting a corporate SFTP server that stored PII/PHI; the company said the intrusion began Nov. 16, 2025 via exploitation of a vulnerability in the SFTP application, was detected Dec. 4, 2025, and resulted in encryption of files on that server only. Sedgwick reported it disabled SFTP connections, restored data from backups the next day, and engaged Mandiant for forensic support, stating the investigation found no compromise beyond the single server.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
By February 2026, San Jose had sent letters to potentially affected individuals about the lost USB drive, including current employees and former employees who had left years earlier. Officials did not disclose how many people may have been impacted.
On February 18, 2026, reporting disclosed the ransomware incident affecting Managed Care Advisors and Sedgwick Government Solutions, including unauthorized access to personal data and protected health information. Sedgwick also said it was offering complimentary credit monitoring, identity theft protection, and identity theft insurance to affected individuals.
On January 15, 2026, Sedgwick confirmed that the affected data included names, addresses, Social Security numbers, dates of birth, and protected health information, with the exact data elements varying by individual. This clarified the scope of information exposed in the ransomware incident.
On January 9, 2026, a City of San Jose workforce member lost a USB drive that may have contained private information, including Social Security numbers, for current and former city employees. The city later described the incident as a potential data breach.
On January 2, 2026, a threat group calling itself TridentLocker claimed responsibility for the Sedgwick incident. The group posted about 3.4 GB of allegedly stolen data on a dark web leak site.
The day after detection, Sedgwick restored the encrypted data on the affected SFTP server from a secure backup. The company reported no evidence that any other systems in its environment were compromised.
On December 4, 2025, Sedgwick detected unauthorized access and ransomware activity affecting its corporate SFTP server. The company disabled all connections to the server and engaged Mandiant to support the forensic investigation.
Managed Care Advisors and Sedgwick Government Solutions later determined that attackers first gained access to a corporate SFTP server on November 16, 2025 by exploiting a vulnerability in the SFTP application. The intrusion was found to be limited to that single server.
3 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourcegovtech.com
Open sourcehipaajournal.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rome’s **La Sapienza University** shut down network systems as a precaution after a cyberattack caused widespread disruption and left its website offline; Italian media attributed the incident to a suspected ransomware operation linked to pro-Russian actor **Femwar02**, with reported tradecraft resembling **Bablock/Rorschach**-style fast encryption. Separately, Romania’s national oil pipeline operator **Conpet** reported a cyberattack that disrupted corporate IT and took down `www.conpet.ro` while leaving **OT/SCADA** and pipeline transport operations unaffected; **Qilin** claimed responsibility, alleging theft of nearly **1TB** of data and posting sample documents (including financial data and passport scans) to support extortion claims. In the U.S., government services contractor **Conduent** faced expanding breach impact from its January 2025 ransomware incident, with notifications indicating exposure potentially reaching **dozens of millions**; reported affected data includes **names, Social Security numbers, and medical/health insurance information**, with at least **15.4M** impacted in Texas and **10.5M** in Oregon per state disclosures. Additional healthcare-sector disclosures included a ransomware-linked intrusion at **Insightin Health** (unauthorized access in September 2025; **Medusa** claimed exfiltration of **378GB**) and a separate compromise at **Clinic Service Corporation** (August 2025 access window), while **Central Ozarks Medical Center** reported a criminal cyberattack affecting **11,818** individuals with exposure of PHI/PII (including SSNs and financial/insurance data). Other items in the set were not incident-specific: an **HHS-OIG** audit describing web application security weaknesses at a large hospital, and general guidance/education pieces on the value of medical records to attackers and **CISA** insider-threat guidance.
Jun 29, 2026
Multiple U.S. healthcare organizations reported **unauthorized network access and patient data exposure**, with several incidents involving confirmed **data exfiltration** and follow-on notification/credit-monitoring actions. **QualDerm Partners** disclosed unauthorized access between **Dec. 23–24, 2025** with files exfiltrated and notifications being sent on a rolling basis, while **Carolina Foot & Ankle Associates** reported a **Dec. 2025** intrusion detected after a network disruption and confirmed exfiltration of files containing PHI (e.g., demographics, MRNs, insurance data, and treatment/billing codes). Additional breach disclosures included **Cedar Point Health** (intrusion detected around **June 16, 2025**, with a months-long data review concluding in late Jan. 2026 and impacted data potentially including SSNs/ITINs and government IDs) alongside separate notifications from **Wee Care Pediatrics** and **Easterseals Northeast Indiana**. Legal and regulatory consequences continued to surface from earlier healthcare incidents. **Asheville Eye Associates** agreed to settle consolidated class-action litigation tied to a **Nov. 2024** attack claimed by **DragonForce ransomware**, which allegedly exfiltrated **~540 GB** before encrypting systems and later leaked data when ransom was not paid; the breach was reported to HHS OCR as affecting **204,984** individuals. Sector-wide reporting also indicated **46** large healthcare breaches logged for **Jan. 2026** on the HHS OCR portal (500+ individuals), exposing **~1.44 million** individuals’ PHI, amid discussion that late-2025 reporting backlogs may have influenced recent month-to-month trends.
Jun 29, 2026
Multiple organizations reported **unauthorized access and data exposure events** affecting large populations, with several incidents tied to third-party systems or business associates. The Minnesota Department of Human Services notified nearly **304,000** people after a user associated with a licensed healthcare provider accessed demographic records in the *MnChoices* system (managed by vendor **FEI Systems**) beyond what was authorized; most impacted records were demographic data, with a smaller subset including some medical information and, for some, the last four digits of SSNs. Monroe University reported a **December 2024** intrusion with data exfiltration affecting about **320,973** individuals, with exposed data potentially including SSNs, government IDs, financial account information, and health/insurance data; notification letters began in early January 2026. Separately, Mid Michigan Medical Billing Service disclosed a **March 2025** cyberattack that exposed PHI for **28,185** individuals across healthcare clients, and VillageCareMAX reported a breach involving business associate **TMG Health** (details referenced as part of a broader business-associate breach update). Other items in the set describe distinct, unrelated security stories rather than the same incident: an underground-market sale of **Raaga** user data (10.2M records, including passwords stored as **unsalted MD5 hashes**), a settlement in litigation tied to the **Veradigm** breach (over 2M patients; **$10.5M** class-action settlement), and a **ransomware** incident at **Valley Eye Associates** where a group identified as **Qilin** claimed exfiltration (139 GB) and published data. Additional references include commentary on UK government handling of an **Afghan data breach** (spreadsheet emailed outside the MoD and use of an injunction) and broader analysis of healthcare breach trends and UK ambulance-service breach reporting; these provide context but do not describe the same specific event as the Minnesota DHS or other named incidents.
Jun 29, 2026