Nutex Health breach: data stolen from hospital operator's servers, then posted online by attacker
Nutex Health, which runs 28 US healthcare facilities, says an attacker stole patient, employee, provider and financial data, then posted it online (10 Sep). Number affected not disclosed. If you've been treated there, watch for notification letters and scam contact.
If you or a parent have been treated at a Nutex Health facility, watch for a notification letter and read it carefully. Be cautious of unexpected calls, texts or emails about medical bills or accounts, and consider a credit freeze if you receive notice.
What’s happening
Nutex Health, a US operator of 28 healthcare facilities across 12 states, told the SEC on 24 August 2026 that an unauthorised third party had accessed and removed information from its servers. On 31 August it said the data includes patient, employee, credentialed provider, and business and financial information, and that the attacker had threatened to publish it. On 10 September it said the attacker had posted the data on its website. Nutex was still checking what the data contains and whether it is genuine, and expected the review to take several weeks. Nutex has not said how many people are affected or which patient details were taken. Infosecurity Magazine reported that the ransomware group The Gentlemen claimed the attack; Nutex has not confirmed this. The company reports no material impact on operations or financial reporting and says it will notify affected patients and employees. Several class actions have been filed in Texas. The latest source we found is dated 10 September; later notifications may exist that we did not find.
- What
- Breach
- Affects
- Nutex Health hospitals and emergency facilities (US)
- Fixed in
- Nothing to patch
- Since
- 24 Aug 2026
- Closed
- 10 Sept 2026
Timeline
- Wider attacks
Nutex said the attacker had posted the allegedly stolen data on its website. The company was analysing it to check what it contains and whether it is genuine, expected the review to take several weeks, and said several class actions were now filed in Texas. It still gave no count of affected people.
- Update
Infosecurity Magazine reported that the ransomware group The Gentlemen had reportedly claimed the attack on its dark web site. This claim was not in Nutex's own filings.
- Vendor revised
In a second filing, Nutex said the stolen information includes patient, employee, credentialed provider, and business and financial information, and that the third party had threatened to publish it. It reported no material impact on operations or financial reporting so far.
- Update
A putative class action, Haley v. Nutex Health, Inc., was filed in the US District Court for the Southern District of Texas (Houston), alleging negligence and related claims.
- Update
BleepingComputer reported the filing. It found no group claiming the attack at that point, and Nutex had not said whether the intrusion involved ransomware.
- Made publicNothing to patch
Nutex Health told the SEC it had found unauthorised activity on its network and that an unauthorised third party accessed and removed information from its servers. It did not say who or how many people were affected, and said it had notified law enforcement and hired outside experts.
Sources
- Nutex Health Form 8-K, 24 August 2026Nutex Health (SEC) · 24 Aug 2026
- Nutex Health Form 8-K (Item 1.05), 31 August 2026Nutex Health (SEC) · 31 Aug 2026
- Nutex Health 8-K cybersecurity update press release, 10 September 2026Nutex Health (SEC) · 10 Sept 2026
- Hospital operator Nutex Health says data stolen in cyberattackBleepingComputer · 25 Aug 2026
- Nutex Health Says Patient Data Stolen, Hackers Threaten LeakInfosecurity Magazine · 2 Sept 2026