Nutex Health reports data breach after attackers access internal network

Healthcare management and operations firm Nutex Health has revealed a cyber security breach, with attackers gaining unauthorised access to its internal systems and extracting sensitive corporate data.

 

Nutex Health is a healthcare technology and operations firm based in Houston, Texas, focused on micro-hospitals and population health management. The company has two primary divisions: its Hospital Division, which operates physician-owned micro-hospitals providing round-the-clock emergency care, diagnostic imaging, and inpatient services, and its Population Health Management Division, which offers technology, billing, and administrative solutions to Independent Physician Associations.

 

In a filing with the U.S. Securities and Exchange Commission (SEC), Nutex Health said that it recently detected unauthorised access to a portion of its intenral network. The company immediately launched an investigation, with assistance from external cyber security experts, to determine the scope of the incident.

 

It also activated its incident response and business continuity protocols and notified law enforcement authorities about the incident.

 

“Based on preliminary findings from the Company’s ongoing investigation, the Company believes that certain information maintained on the Company’s servers was accessed and exfiltrated by an unauthorised third party, including some information that may be private and/or confidential,” Nutex Health said.

 

The company said it is continuing to investigate whether sensitive information—including patient, employee and provider data, confidential business and financial records, and intellectual property—was accessed or exfiltrated during the incident. It is also evaluating the potential impact of the unauthorized activity, including whether any private or confidential information was disclosed by the third party.

 

However, the company stated that, as of now, it has not identified any material or significant impact on its day-to-day business operations, internal processes, or financial reporting systems as a result of the incident.

 

“As of the date of this Current Report on Form 8-K, the Company does not believe that the unauthorised access has had, or is reasonably likely to have, a material impact on the Company’s business strategy, operations, financial condition or results of operations,” Nutex Health added.

 

At the time of publishing, no known hacker group claimed responsibility for the cyber attack on Nutex Health. The company also did not share details on who was behind the attack, how much data was compromised, or whether it had received a ransom demand.