There's no relief from healthcare hackers in 2024

After a record 133 million individuals had their healthcare data stolen or otherwise exposed in 2023, the first few months of 2024 suggest there's no letup in data breaches. 

As of Thursday, about 11.6 million people had their data exposed this year from 79 reported breaches affecting 500 or more individuals, according to the Health and Human Services Department's Office for Civil Rights breach portal. The data doesn't include the effect of the latest massive breach, the cyberattack that hit Change Healthcare on Wednesday and continued Thursday. It also doesn't include the breach by a "known criminal threat actor" that took down systems at Lurie Children's Hospital in Chicago late last month.

The 11.6 million people figure represents the highest number for the first two months of any year since tracking of breaches began in 2010, except for 2015 when the Anthem breach affected almost 79 million people.

Three of the top 10 breaches this year involved more than 1 million individuals each. In early January, Concentra reported a breach affecting almost 4 million people connected to the Perry Johnson & Associates breach in 2023. That breach of the medical transcription company affected about 9 million people. Concentra chose to report their breach separately from Perry Johnson.

Integris Health and Medical Management Resource Group each reported breaches involving about 2.4 million people. In the top three 2024 breaches, personal data including Social Security numbers were reportedly compromised. 

Regardless of when data breaches are reported to the HHS portal, they could have occurred several months earlier. January reports may include breaches that occurred in 2023 and January 2023 reports may include 2022 breaches.