Two U.S. nonprofit healthcare organizations have separately confirmed data security breaches exposing sensitive patient and member information. Colorado Health Network Inc., an HIV/AIDS services provider, disclosed that an unauthorized third party accessed and exfiltrated files containing highly sensitive patient data, an incident the Cephalus ransomware group claimed in August 2025 with a boast of more than 900 GB stolen. Kentucky Mountain Health Alliance, a Hazard, Kentucky primary and specialty care nonprofit, also announced a breach. In both cases the organizations released only limited details about how the attacks occurred or how long intruders had access.
What Happened
Colorado Health Network confirmed that an unauthorized third party accessed its systems and removed files. The notification omitted both the date the breach was detected and how long the attackers maintained access, leaving a meaningful gap in the public timeline. The organization began mailing notification letters to affected individuals on June 18, 2026, and stated it has received no reports indicating the exposed data has been misused.
Evidence points to a ransomware attack by the Cephalus group, which posted a claim on its dark web leak site on August 28, 2025, asserting it had stolen more than 900 GB of data. That leak site is no longer reachable, so it is unclear whether the stolen data was ever published. Notably, while 257 Texas residents were reported affected to the Texas attorney general, and the Colorado-based footprint implies well over 500 victims, the incident does not yet appear on the HHS Office for Civil Rights breach portal.
Kentucky Mountain Health Alliance, a nonprofit delivering primary and specialty care in eastern Kentucky, separately announced a breach affecting patient or member data. Details remain sparse at the time of disclosure.
What Was Taken
The Colorado Health Network exposure is severe in both breadth and sensitivity. Reviewed files contained patient names combined with one or more of the following: Social Security numbers, driver's license or state identification numbers, passport numbers, financial account information, debit and credit card information, and health insurance details that may include Medicaid and Medicare information.
The medical data is especially damaging. It may include diagnoses, diagnosis codes, mental and physical condition information, prescription details, and provider or location data. Because Colorado Health Network serves individuals living with HIV/AIDS, the exposed diagnostic information carries elevated risk of stigma, discrimination, and targeted extortion. Cephalus claimed roughly 900 GB of exfiltrated data, a volume consistent with a full database and document store compromise.
Why It Matters
Healthcare records remain among the most valuable and reusable data on criminal markets because they bundle identity, financial, and medical attributes that cannot be reset like a password. For a population already vulnerable to discrimination, the leak of HIV/AIDS-related diagnoses raises the stakes beyond ordinary identity theft into coercion and privacy harm.
The reporting gaps also matter for defenders and regulators. An incident that plausibly affects more than 500 individuals yet is absent from the OCR breach portal signals either a delayed filing or an undercounted scope. The lag between Cephalus's August 2025 claim and the June 2026 notification underscores how long victims can remain exposed before disclosure, and how double-extortion ransomware crews exploit that window.
The Attack Technique
Specifics are limited, but the Colorado Health Network incident bears the hallmarks of a double-extortion ransomware operation: unauthorized network access, bulk file exfiltration, and a public claim on a dark web leak site to pressure payment. Cephalus's posting of a 900 GB haul indicates the actors prioritized data theft for leverage, regardless of whether systems were also encrypted. The takedown or unavailability of the leak site leaves the question of public exposure unresolved. Initial access vectors were not disclosed, but ransomware affiliates commonly rely on phishing, stolen or weak credentials, exposed remote access services, and unpatched internet-facing systems. The Kentucky Mountain Health Alliance attack technique has not been detailed.
What Organizations Should Do
- Enforce phishing-resistant multi-factor authentication on all remote access, VPN, email, and administrative accounts to close the most common ransomware entry points.
- Deploy and monitor for large outbound data transfers, since exfiltration of hundreds of gigabytes should trigger data loss prevention and egress alerts well before a leak-site claim.
- Segment networks and restrict access to systems holding regulated PHI, limiting how far an intruder can pivot after initial compromise.
- Maintain tested, offline backups and a rehearsed incident response plan that includes regulatory notification timelines under HIPAA and state breach laws.
- Patch and inventory internet-facing services promptly, and disable unused remote access pathways that affiliates routinely scan for.
- Affected individuals should monitor account statements, free credit reports, and explanation of benefits notices, and enroll in any offered credit monitoring and identity theft protection.
Sources: Colorado Health Network; Kentucky Mountain Health Alliance Announce Data Breaches