Cognitive Health Technologies LLC, a New York healthcare technology company, has confirmed that an unauthorized third party was inside its network from February 5 to April 28, 2026, and took files containing protected health information. The company's breach notice, as reported by HIPAA Journal, puts the number of affected people at 49,467. Every source that gives an exact count uses that figure. Headlines rounding it to 49,500 describe the same number. The disclosure was published alongside smaller healthcare breach notices from City Ambulance Service and Innovative Alternatives in Texas, Baraga County Memorial Hospital in Michigan and The Speech Clinic in Georgia. Taken together, they show how many providers small and large are still disclosing incidents months after the attacks took place.
What Happened
According to the company's substitute breach notice, as reported by HIPAA Journal, Cognitive Health Technologies spotted suspicious network activity on April 27, 2026. It brought in forensic investigators, who found that an attacker had been inside the network since February 5. The investigation recorded the intrusion as continuing until April 28, the day after detection. That means the attacker was present for about 12 weeks before anyone noticed, and still had access for at least a day after the company began responding.
ClaimDepot and the law firm Cole & Van Note both say the breach was reported to the HHS Office for Civil Rights on October 8, 2026, and that notification of affected individuals began around the same date. That was roughly five months after discovery. The company has not explained the gap. HHS rules allow up to 60 days after a breach is discovered, although a data review that runs long often pushes the "discovery" of affected individuals later. ClaimDepot also lists breach notices filed with the California, Iowa and Maine attorneys general.
Descriptions of the company's business vary. HIPAA Journal calls it a healthcare technology and IT consulting company. ClaimDepot describes it as a revenue cycle management vendor. Barnow and Associates calls it an "AI healthcare revenue management company." Cole & Van Note says it provides business associate services to medical providers. Whichever description is most accurate, the practical result is the same: many of the people affected probably never dealt with the company directly and may not recognise its name on a breach letter.
No threat actor has claimed the attack, and the company has not said whether ransomware was involved.
What Was Taken
According to the company's notice as reported by HIPAA Journal, the compromised data included:
- Names
- Dates of birth
- Health insurance information
- Medical histories
- Treatment information
Barnow and Associates and Cole & Van Note give the same list, as does the breach summary published by DataBreachRights. ClaimDepot's summary page goes further and also lists Social Security numbers, addresses, government IDs and financial information. The company's notice does not confirm these categories. ClaimDepot's own description of the incident on the same page sticks to the narrower list, so the extra categories may be a template default and not a finding. Until the company or a regulator filing says otherwise, treat the narrower list as the confirmed scope.
Even without Social Security numbers, this mix of data is valuable to criminals. Insurance details combined with medical histories make medical identity fraud and convincing health-themed phishing possible, and medical history cannot be changed the way a password or card number can. The company says it has found no misuse of the data so far.
Why It Matters
Vendors hold patient data that patients never knowingly gave them. Revenue cycle and billing vendors collect records from many provider clients, so a single intrusion exposes patients of practices that were never breached themselves. Healthcare organisations remain responsible for their business associates' security under HIPAA, but most have little visibility into how those vendors watch their networks.
The attacker went unnoticed for roughly 12 weeks. The company has not said how it eventually spotted the activity, but an attacker who can move around a network for nearly three months before detection had time to find and stage files at leisure.
The other notices in this batch show the same patterns. HIPAA Journal reports that City Ambulance Service in Spring, Texas (Viking Enterprises) told HHS about an email-related hacking incident affecting 14,324 people. According to its filing with the Texas Attorney General, Social Security numbers were among the data exposed. HIPAA Journal's coverage also connects the Qilin ransomware and extortion group to that incident, though City Ambulance has not confirmed this publicly. In a separate case, The Record reported in October that the cardiac monitoring company iRhythm lost data on at least 360,000 people. In that attack, social engineering gave intruders access to business applications hosted by a third party. The common threads are attackers going after business systems rather than clinical ones, and long delays between intrusion and notification.
The Attack Technique
Cognitive Health Technologies has not said how the attacker got in. Its notice describes unauthorized network access followed by "access and acquisition" of files and folders, which means data was copied out and not just viewed. The company has not said whether it found malware or encryption, which credentials were used, or whether the entry point was a remote access service, a phishing email or a weakness in a system exposed to the internet. No regulator filing has added technical detail, and no group has claimed the attack on a leak site.
The long stay in the network, followed by copying of files, matches how data-theft extortion crews usually operate. Without confirmation from the company, though, that is a comparison and not an attribution.
What Organizations Should Do
- List every business associate that holds patient data and check how it detects intrusions. Ask revenue cycle, billing and IT consulting vendors how quickly they would detect an intrusion, how long they keep logs, and how fast they would notify you. Put those commitments into your business associate agreements.
- Reduce the data you send vendors and limit how long they keep it. Billing vendors rarely need full medical histories. Send only the fields each workflow needs, and require vendors to delete records on a set schedule.
- Watch for large or unusual data transfers out of file servers. Copying files at scale to an outside destination is the stage of this kind of attack that can be detected. Alert on unusual archive creation, bulk reads from file shares and outbound transfers to cloud storage you don't use.
- Require phishing-resistant multi-factor authentication on remote access and email. The City Ambulance and iRhythm incidents both involved email or social engineering. Use hardware keys or passkeys for administrators and anyone with remote access.
- Keep enough logs to investigate a long intrusion. An attack that runs for 12 weeks can only be fully reconstructed if authentication and file access logs go back at least 90 days, and ideally longer.
- Prepare patient communications in advance. When the breached company is a vendor, patients will not recognise its name. Have template notices ready that name your organisation as the source of the relationship, so letters are not mistaken for phishing.
Sources: Cognitive Health Technologies Data Breach Affects ... | Hundreds of thousands impacted by data breach at biosensor firm iRh... | Cognitive Health Technologies Data Breach Exposes Medical Information | Cognitive Health Technologies Data Breach Explained | Cognitive Health Technologies Data Breach Investigation - Cole & Va... | Cognitive Health Technologies Data Breach Affects 49,500 Individual... | Cognitive Health Technologies Data Breach Affects 49,500 Individual... | Cognitive Health Technologies LLC Data Breach Investigation Barnow...