Nutex Health Discloses Major Data Breach: 28 Hospitals, 12 States, $875M Micro-Hospital Network

On 24 Aug 2026, Nasdaq-listed micro-hospital operator Nutex Health (NUTX) filed an 8-K with the SEC disclosing a data breach. Nutex runs 28 micro-hospitals and ERs across 12 U.S. states, with 2025 revenue of $875 million. An unauthorized third party accessed and exfiltrated data from company servers.

On 24 Aug 2026, Nasdaq-listed micro-hospital operator Nutex Health (NUTX) filed an 8-K with the SEC disclosing a data breach. Nutex runs 28 micro-hospitals and ERs across 12 U.S. states, with 2025 revenue of $875 million. An unauthorized third party accessed and exfiltrated data from company servers. Filing language implies the actor may use public leak as extortion leverage. As of 26 Aug, no ransomware group has claimed the incident.

Incident overview

• Filer: Nutex Health Inc. (NASDAQ: NUTX), Houston, Texas
• Disclosure date: 24 Aug 2026 (8-K signed by CFO Jon C. Bates)
• Footprint: 28 micro-hospitals / ER facilities in 12 states (Texas, Wisconsin, Arkansas, and others)
• Revenue: ~$875 million in 2025
• SEC item: Item 8.01 (Other Events), not Item 1.05 (Material Cybersecurity Incidents) — company currently judges the event below the materiality threshold

Confirmed facts:

1. Unauthorized access and data exfiltration occurred 2. Stolen data may include private or confidential information 3. Third-party IR/forensics engaged; internal cyber incident plan activated 4. Law enforcement notified 5. Investigation open — patient, employee, physician, financial, and IP data categories not yet finalized

Technical details

Nutex has not disclosed initial access, dwell time, lateral movement, or exfiltrated fields. Filing language plus typical extortion ops point to these risks:

• Double extortion: the 8-K phrase "the third party may attempt to publicly release the stolen data" is classic extort-without-ransom-note wording. Expect dark-web or leak-site dumps, skipping a visible pay-or-not negotiation
• Micro-hospital attack surface: distributed small ERs plus physician partnerships. Each site has EMR, HIS, billing, imaging, and vendor interfaces — far more edge than a single large hospital
• Likely data classes (per SEC scope): patient clinical records, insurance data, employee files, physician license credentials, corporate financials, IP
• Identity + clinical combo: medical records joined with SSN and biometrics beat pure financial data for targeted social engineering and insurance fraud

Impact assessment

Victim count is unpublished. Annual ER volume can hit hundreds of thousands, plus staff and physicians — affected individuals may exceed six figures. Stacked on August's CareCloud (3.7M), Unlimited Technology Systems (3.8M), and Brown Health Medical Group (311k) healthcare incidents, 2H 2026 healthcare breach volume is clearly up.

Patient and employee harm paths:

• Identity theft: SSN + DOB + address used to open credit or claim government benefits
• Health-insurance fraud: order high-cost drugs or submit treatment claims under the patient
• Prescription fraud: controlled substances via patient or physician identifiers
• Targeted social engineering: medical history and visit records make phishing more credible
• Business harm: employee performance and contract leaks become governance and legal disputes

Remediation and recommendations

For Nutex patients / employees:

• Watch Nutex notification mail (verify address and domain; expect spoofing)
• Enable credit monitoring at the three bureaus for the next 12 months
• Add MFA or PIN on all insurer accounts; flag unknown clinic or physician names on EOBs
• Nutex staff: rotate passwords on any reused external service; turn on hardware security keys
• Physicians: recheck DEA status and Medicare prescribing rights; report suspicious activity

For healthcare orgs (including Nutex-like micro-hospital networks):

• Third-party legal/risk audit of outsourcing partners, HIS, and billing; put every interface behind network ACLs
• East-west detection plus anomalous file-egress alerts (volume, time window, destination)
• AD/LDAP behavior baselines plus UEBA for in-domain lateral movement
• Attribute-based credential rotation; no credential TTL over 24 hours
• Isolate internet-reachable backups so they are not a second leak source

Sources

• SEC 8-K: NUTX Form 8-K 2026-08-24
• BleepingComputer: Hospital operator Nutex Health says data stolen in cyberattack
• SecurityWeek: Sensitive Information Exposed in Nutex Health Data Breach
• HackWire incident recap: Nutex Health leak analysis