Nutex Health (NASDAQ: NUTX) is a Houston-based operator of micro-hospitals, specialty hospitals and hospital outpatient departments. It has told the SEC that an unauthorized third party accessed and stole data from its servers. The stolen data includes private and confidential patient, employee, credentialed provider, business and financial information. The company has confirmed the theft in three Form 8-K filings, dated August 24, August 31 and September 10, 2026. The Gentlemen, a ransomware-as-a-service group, put Nutex on its leak site on August 31 and claimed the attack, according to The Register. On September 10, Nutex said the attackers had published the data they allegedly obtained. Nutex has not named the attackers itself and has not said how many people are affected. Several proposed class actions have already been filed.
What Happened
The timeline below comes from the company's own filings and press release, with security press coverage added where noted:
- August 24, 2026: Nutex disclosed the incident under Item 8.01 ("Other Events") of Form 8-K. It said it had found unauthorized activity involving data stored on its network. It activated its incident response plan, put containment measures in place, notified law enforcement, and brought in an independent cybersecurity response team and forensic experts. Sources describe this first filing slightly differently. NetSec.News and The Register say Nutex already believed at that point that some private or confidential information had been exfiltrated, and that the open question was which categories were affected. HIPAA Journal describes the filing as not yet having determined whether private and confidential data was compromised, while noting that Nutex knew the threat actor might disclose information. At that stage Nutex said it did not expect a material impact.
- August 27, 2026: A proposed class action was filed on behalf of people whose PII or PHI was allegedly accessed (The Register). Becker's Hospital Review reports that several suits have since been filed in the U.S. District Court for the Southern District of Texas, Houston Division.
- August 31, 2026: Nutex re-filed under Item 1.05, the section for material cybersecurity incidents. It confirmed that data had been accessed and exfiltrated, and that the third party had threatened to publish it. On the same day, The Gentlemen listed Nutex on its leak site. The Register notes the group gave no evidence for its claim.
- September 10, 2026: Nutex issued a press release and filed an accompanying 8-K. The SEC archive labels that 8-K as filed September 11 and gives a report date of September 10. Nutex said the attacker had published the allegedly stolen data on its own website. The company is downloading and analyzing that data to establish its contents, scope and authenticity, and expects the review to take "several weeks" because of the volume. It said its materiality assessment from August 31 has not changed and that it has found no material impact on operations or financial reporting systems.
One later report differs from this record. CIO Monitor, citing BleepingComputer on October 11, says Nutex "has not yet detailed the scope of the stolen data or attributed the attack." The company has in fact listed the categories of data stolen. What it has not given is volumes or a count of affected people, and it has not formally attributed the attack. The only attribution so far is The Gentlemen's own claim, as reported by The Register.
The sources also disagree slightly on the size of the company. HIPAA Journal says Nutex operates 27 facilities across 12 states. Nutex's own press release, The Register and Becker's all say 28 facilities in 12 states.
What Was Taken
According to the August 31 Item 1.05 filing, as reported by NetSec.News, The Register and HIPAA Journal, the stolen information includes:
- Patient information (which may include protected health information)
- Employee data
- Credentialed provider information
- Confidential business and financial information
The first filing also listed intellectual property among the categories still under review. No later source confirms whether any IP was taken.
Volume is unknown. None of the eight sources gives a record count, a number of affected people, or a data size. Nutex's only statement on volume is that the leaked dataset is large enough that reviewing it will take several weeks. No breach report to HHS OCR appears in the sources. Nutex says it is still evaluating its regulatory and legal notification obligations and intends to notify affected patients and employees.
Because the data has been published on the attacker's site, defenders and affected people should assume it is already circulating. Nutex has not yet confirmed that the leaked data is authentic.
Why It Matters
Healthcare double extortion is still working as a business model. The pattern here is a common one: steal the data, threaten to publish it, list the victim on a leak site, then publish. The Register notes that naming victims on a leak site is a standard pressure tactic. Neither Nutex nor any other source says whether files were encrypted or whether a ransom was demanded or paid. The company reports no operational disruption, which suggests this was mainly a data-extortion event.
The Gentlemen are a relatively new group. The Register reports that the group appeared in mid-2025, reportedly after former Qilin affiliates fell out with that operation. Healthcare defenders should expect affiliate playbooks similar to Qilin's, with a focus on exfiltration and leak-site pressure.
SEC disclosure under pressure. Nutex moved from an Item 8.01 filing to an Item 1.05 filing within a week, as the facts developed. Meanwhile it has continued to say it sees no material impact on operations or financials. Other public healthcare operators can use this as a reference for how materiality disclosures play out in practice.
Litigation starts within days. The first class action was filed three days after the initial disclosure, before Nutex had finished scoping the breach. Organizations should plan legal response alongside forensics from the start, not afterwards.
The Attack Technique
How the attackers got in has not been disclosed. None of the eight sources describes the initial access vector, dwell time, exploited vulnerabilities, or whether ransomware was deployed to encrypt systems. Nutex's filings describe the intrusion only as "unauthorized activity involving data stored on its computer network."
What can be established:
- Data was exfiltrated from company servers before or during the period of discovery.
- The attacker ran a leak-site extortion workflow: a threat to publish, a public listing on August 31, then publication by September 10.
- The claimed operator, The Gentlemen, runs as a RaaS. That means the intrusion may have been carried out by an affiliate whose methods differ from those of other Gentlemen victims.
Any specific TTPs attributed to this incident should be treated as unverified until Nutex or a forensic party publishes them.
What Organizations Should Do
- Monitor and limit egress from data stores. This incident was centered on exfiltration. Alert on unusual outbound volume from file servers, EHR-adjacent databases and backup systems, and restrict direct internet egress from server segments.
- Hunt for indicators tied to The Gentlemen and Qilin affiliates. The group reportedly grew out of Qilin's affiliate base, so review Qilin-associated TTPs in threat intel feeds and check your detections against them, especially for remote access abuse and credential theft.
- Map where PHI and workforce data live. Nutex has said the leaked dataset will take weeks to analyze. Keep a current inventory of where patient, employee and credentialed-provider data sit, so that scoping takes days instead of weeks.
- Prepare SEC and HIPAA disclosure paths in advance. Public healthcare operators should have pre-drafted Item 8.01 and Item 1.05 language, a materiality decision framework, and HHS OCR notification workflows ready to run in parallel.
- Bring in counsel at the first sign of an incident. Class actions arrived within 72 hours of disclosure. Engage outside counsel early, preserve evidence carefully, and keep public statements consistent across filings.
- Watch leak sites for your own organization and your vendors. Credentialed provider and business data can expose third parties. Subscribe to leak-site monitoring for your organization and for your key healthcare partners.
Sources: Nutex Health Confirms Data Stolen in Healthcare Cyberattack — CIO M... | Nutex Health Inc. Form 8-K filed September 11, 2026 | Nutex Health Confirms Sensitive Data Stolen in August Cyberattack | The Gentlemen come calling as Nutex confirms sensitive data theft | Nutex Health data posted online after cyberattack, lawsuits mount -... | NUTEX HEALTH PROVIDES UPDATE REGARDING CYBERSECURITY EVENT - Nutex... | Nutex Health Inc. (via Public) / Material Cybersecurity Incidents (... | Nutex Health Confirms data theft in cyberattack - NetSec.News