Southeast Healthcare Breaches: One Vendor, Ten Million People

Between July and September, 35 healthcare organizations in the Southeast reported breaches of 500 or more people to HHS. That’s slightly fewer than the 39 reported in the second quarter. The number of people affected went the other way: 10.1 million, more than double the 4.6 million in Q2. Nearly all of these breaches (94%) were hacking or IT incidents, so in almost every case someone from outside got in.

One vendor, 95% of the people

Most of the jump came from a single source. Aesto, a records-archiving vendor based in Alabama, reported a breach affecting 9.5 million people, about 95% of everyone affected in the region this quarter. Vendors were involved in 9 of the 35 breaches overall. For many practices, the biggest exposure isn’t their own network but the companies that store, bill or process their patient data.

This is a small-practice problem

Take Aesto out and a different picture appears. Thirty of the 35 breaches affected fewer than 10,000 people, and the typical (median) breach affected 1,283. These were clinics, specialty groups and independent practices, not large health systems. Smaller organizations often assume they’re too small to be targets, but this quarter’s numbers show otherwise.

Email is still a front door

Ten of the 35 breaches involved email, and most of the rest hit network servers. Email remains one of the easiest ways in, especially shared inboxes and accounts without multifactor sign-in.

Where it happened

Florida led the region with 11 breaches, followed by North Carolina with 6 and Tennessee with 4. West Virginia and Arkansas each reported 3, Georgia, Alabama and South Carolina 2 each, and Louisiana and Virginia 1 each. Kentucky and Mississippi reported none of 500 or more this quarter.

One thing to do this quarter

List every vendor that touches your patient data, and check what each contract says about telling you about a breach and how quickly. If a vendor’s breach reached you tomorrow, that clause would decide how your first week goes.

The full report, including breaches by state, is on our Resources page. A new report comes out each quarter, and the monthly Southeast Breach Watch follows the numbers in between.

Source: HHS Office for Civil Rights breach portal, breaches of 500 or more people from AL, AR, FL, GA, KY, LA, MS, NC, SC, TN, VA and WV submitted July 1 through September 30, 2026, exported October 17, 2026. Counts reflect what entities reported and may be revised.