2026 Well Child — temporary storage server exfil; school health PHI (≥500 OCR placeholder)
Data compromised
Student vision screening reports/data, available-students lists, PEDS assessments: names, DOB, MRNs, providers, diagnoses, test results, treatment dates, billing/procedure codes; SSNs for limited individuals
Technical writeup
Verified organization notification summarized by HIPAA Journal — September 7, 2026. Well Child (TN/MS school-based healthcare) identified incident June 1, 2026, took servers offline; June 5 confirmed exfiltration from a temporary storage server. Review ongoing; OCR filing uses ≥500 placeholder pending final census. recordsAffected 500 (placeholder); companyConfirmed true.
Root cause
Unauthorized activity; files exfiltrated from temporary storage server (confirmed Jun 5)