In May 2023, Northern-California hospital giant , Sutter Health, saw the personal and medical details of more than , 845,000 patients, siphoned off after its patient-engagement vendor , Welltok (doing business as Virgin Pulse), was compromised during the massive , MOVEit Transfer zero-day, campaign attributed to the , Cl0p ransomware gang, . The trove-later uploaded to an underground breach marketplace in December 2024 at roughly , 1.46 million database rows, -contained highly sensitive protected-health information (PHI).  ,

, What was exposed,   ,

, Attackers made off with full names, home addresses, phone numbers, email addresses, dates of birth, insurance-provider details, doctor names, treatment and diagnosis codes, as well as clinical metrics such as weight and blood-pressure readings-enough data to assemble a cradle-to-grave medical dossier on every affected patient. Unlike many healthcare incidents, Social Security and payment-card numbers were , not, in the Welltok dataset, but security experts warn that the breadth of PHI is still more than sufficient for targeted medical identity theft and extortion schemes.  ,

, How the breach happened,   ,