The Biggest Health Breach of the Year Happened at a Company With No Patients

The largest healthcare exposure reported in 2025 involved more than 25 million people, with names, dates of birth, Social Security numbers, treatment details and claims information. It originated at a third-party vendor providing back-office administrative services to healthcare organisations and government agencies.

This is now a pattern rather than an observation. Conduent at 26-0731 reached 62.2 million. Change Healthcare exceeded 190 million. Episource at 25-0605 reached 5.4 million. The health IT vendor at 25-0515 reached 442,000 across an unnamed customer base.

The organisations that patients have relationships with are not producing the largest breaches. The organisations behind them are.

A hospital holds its own patients. A back-office administrator holds the patients of every client it serves, in one estate, with the field set required to process claims — which is the identity fields plus the clinical fields plus the financial fields.

Efficiency drove that consolidation and the efficiency is real. The security consequence was never priced into the outsourcing decision, because it falls on people who are not party to it.

They cannot evaluate the vendor, did not select it, are frequently not told its name until a notification arrives, and cannot take their data elsewhere — because the relationship that produced the data was with a hospital or a state agency, not with the company that lost it.

It is the structure this desk filed at Volvo in 26-0211 and at Texas Parks and Wildlife in 26-0628. In healthcare it operates at the largest scale in this database.