2026 Midwest Spine and Brain Institute — 3C Care Systems vendor breach (patient PHI)
Data compromised
Names with DOB, medical treatment/procedure/diagnosis, MRN, provider, prescriptions, dates of service, health insurance claim/policy info; SSN for some (monitoring offered)
Technical writeup
Verified patient notification summarized by HIPAA Journal — September 4, 2026. Midwest Spine and Brain Institute (MN/WI) alerted patients after learning patient data was accessed/obtained from vendor 3C Care Systems. MSBI said its larger network was not impacted. Investigation concluded June 18, 2026; PHI/PII categories listed; identity monitoring offered where SSNs involved. OCR portal count not shown at press time. Trade coverage links the vendor incident to a ~Nov 21, 2024 RansomHub claim (~100 GB) that remains unverified as to other clients. recordsAffected 0; companyConfirmed true.
Root cause
Third-party healthcare IT vendor (3C Care Systems) breach; MSBI network not compromised