Breaches and incidents
WindRose Health Network (Indiana): vendor’s remote access tool zero-day exploited, 33,158 affected
Per HIPAA Journal, WindRose is notifying 33,158 people after attackers exploited “a previously undisclosed vulnerability in a remote access tool used by...
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- Per HIPAA Journal, WindRose is notifying 33,158 people after attackers exploited “a previously undisclosed vulnerability in a remote access tool used by one of its vendors” between 3 and 4 Aug 2026; data included names, patient IDs, insurance information, dates of service and provider names.
- Root cause: zero-day in a vendor’s remote access tool.
- No attacker named.
- WindRose secured its environment and engaged investigators.