Nutex discloses theft of patient data after breach

Nutex Health has confirmed that an unauthorised third party stole sensitive patient, employee, provider, business and financial information from its computer network and threatened to publish the data externally.

The Houston-based healthcare provider disclosed the findings in an August 31 filing with the US Securities and Exchange Commission, upgrading its earlier notification of the intrusion to a report under the regulator’s category for material cybersecurity incidents. The company said its investigation remained under way and that it was still assessing the full scope of information accessed, acquired or exfiltrated.

SEC rules require publicly traded companies to report cybersecurity incidents they determine are material, generally within four business days of that determination, and to describe the material aspects of the event’s nature, scope, timing and actual or reasonably likely impact.

Nutex said the compromised material included private or confidential information relating to patients and employees, credentialed providers, its business operations and finances. It is also examining whether intellectual property or other sensitive records were taken. The company has not disclosed how many people may be affected, the volume of data stolen or the precise types of patient information involved.

The attacker has threatened to release the information publicly, according to the company. Nutex did not identify the intruder or describe any ransom demand in its SEC filing. A ransomware operation known as The Gentlemen has separately claimed responsibility for the attack on its leak site, but that assertion has not been independently established and Nutex has not attributed the intrusion to the group.

The disclosure marks a significant change from Nutex’s first regulatory filing on August 24, when it said preliminary findings showed that information stored on its servers had been accessed and exfiltrated but that it was still determining whether patient, employee, provider, financial, business or intellectual property records had been compromised.

Nutex said it engaged an independent cybersecurity response team and forensic specialists after detecting the unauthorised activity, activated its cybersecurity response plan, implemented containment measures and notified law enforcement. It has not identified a material impact on business operations or its financial reporting systems.

The company is continuing to evaluate regulatory and legal notification requirements and said it intends to make all required notifications based on the investigation, including notices to affected patients. It has not specified when those notifications will begin or whether identity-protection services will be offered.

The incident has also triggered litigation. A proposed class action, Haley v. Nutex Health, Inc., was filed on August 27 in the US District Court for the Southern District of Texas, Houston Division, on behalf of people whose personally identifiable information or protected health information was allegedly accessed or acquired during the intrusion.

The complaint alleges negligence, negligence per se, breach of third-party beneficiary contract and unjust enrichment. It seeks compensatory and consequential damages, injunctive relief, credit monitoring, identity-theft insurance and legal costs. Nutex said it cannot predict the outcome of the case or estimate the incident’s potential effect on its business strategy, operations, financial condition, results or share price.

The company’s latest SEC filing does not state how the attackers gained access, when the intrusion began, how long they remained inside its systems or whether files were encrypted. It also does not say whether clinical systems, hospital equipment or patient-care services were disrupted.

Nutex operates a network of micro-hospitals, specialty hospitals and hospital outpatient departments alongside a population health management business. Its latest quarterly filing said the company had 27 hospital facilities across 12 US states as of June 30, employed about 1,037 full-time staff, contracted with more than 280 doctors at its facilities and partnered with more than 3,600 physicians through its provider networks.

For the first six months of 2026, Nutex reported hospital division revenue of $409.4 million, down 7 per cent from the same period a year earlier, while patient visits rose 6.2 per cent. Its population health management division recorded revenue of $17.8 million during the same period.