Personal health data leaked: what it means and what to do
Risk level: critical. Can you change it: no. Found in 7 breaches in this directory.
What this data is
Information about your physical or mental health: diagnoses, medications, test results, conditions, fitness and cycle tracking, therapy notes and insurance claims, held by clinics, apps, insurers and wellness services.
The risk on its own
Health data is permanent and deeply personal. A diagnosis cannot be changed like a password, and some conditions carry stigma that affects work, relationships and insurance. Criminals know people will pay to keep this information private.
The risk combined with other data
With your name, address and insurance or Medicare number, health data supports medical identity theft, where someone receives treatment or prescriptions billed to you. That can put false information into your medical record. Tied to your contact details it is also direct extortion material, as patients of the Finnish therapy provider Vastaamo found in 2020.
How criminals use it
An extortion email threatens to publish your therapy notes or diagnosis unless you pay.
Someone uses your insurance or health number to get treatment or prescriptions, leaving false entries in your file.
A scammer poses as your clinic, references your real condition, and asks for payment for a new treatment.
Reproductive or sexual health details from a tracking app are exposed to family or a partner.
What to do now
Ask the provider exactly which records leaked and whether your health or insurance number was included.
Check your insurer and Medicare or health account statements for services you never received.
Ask your insurer or health agency whether the membership or health number can be reissued.
Do not pay extortion demands. Report them to police and to the provider, and keep the messages.
Delete or tighten health tracking apps you no longer need, and switch off data sharing in their settings.
Contact a support service such as your GP or a mental health helpline if the exposure is causing distress.
Frequently asked questions
Can my health data be used to steal my identity?
Yes. Medical identity theft uses your details to obtain care or prescriptions, and it can add false information to your records.
Should I pay a hacker who threatens to publish my health records?
No. Paying does not guarantee deletion and marks you as someone who pays. Report it to police and the provider.
Can my employer or insurer use leaked health data against me?
Many countries restrict that, but laws vary. Get advice if you believe leaked data has been used in a decision about you.
Breaches that exposed this data
Unverified Data Source: 2021-01-26, 11M accounts, Bank account numbers, Credit status information, Dates of birth, Email addresses, Employers, Health insurance information
Exact Sciences: 2026-07-15, 11M accounts, Dates of birth, Email addresses, Genders, Names, Personal health data, Phone numbers
McKesson: 2026-08-21, 6.4M accounts, Dates of birth, Email addresses, Employers, Genders, Names, Personal health data
CyberServe: 2021-10-29, 1.1M accounts, Dates of birth, Drinking habits, Email addresses, Family structure, Genders, Geographic locations
Health Now Networks: 2017-03-25, 322K accounts, Dates of birth, Email addresses, Genders, Health insurance information, IP addresses, Names
Vastaamo: 2019-03-31, 30K accounts, Email addresses, Names, Personal health data, Social security numbers
CTARS: 2021-05-21, 12K accounts, Dates of birth, Email addresses, Genders, Names, Passwords, Personal health data
Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.