Ransomware Gang Claims Nutex Health Patient Data

SEC notification filed. A ransomware group has claimed a breach of Nutex Health, a Houston-based emergency and micro-hospital operator. The company notified the Securities and Exchange Commission that hackers accessed patient, employee, provider, business, and financial information, according to SecurityWeek and The Record.

Status as of September 2, 2026

• Breach: confirmed. Nutex filed with the SEC.
• Threat actor claiming credit: a ransomware group. Specific group not named in public reporting as of this article.
• Data types confirmed accessed: patient data, employee data, provider data, business data, financial data.
• Volume: unconfirmed.
• Ransom payment status: not disclosed publicly by Nutex.
• Initial access vector: not disclosed.
• Incident timing: August 2026, per The Record.

Confidence Flags

Threat actor identity: unconfirmed by public sources. SecurityWeek’s report references a ransomware gang claim; attribution to a specific operation has not been established.

Data volume: no figure published by Nutex or confirmed independently.

Whether protected health information is in scope beyond the general “patient data” language: not confirmed. SEC 8-K filings set the materiality threshold. An HHS OCR breach notification, if filed, will establish the HIPAA record count.

Context

Nutex Health operates a network of emergency hospitals and micro-hospitals across the United States. Healthcare facilities handle protected health information regulated under HIPAA. SEC filing signals material impact under the commission’s cyber disclosure rules adopted in 2023.

Analysis: ransomware claims against healthcare have been elevated this month. McKesson’s breach carries an active ShinyHunters extortion deadline. FulcrumSec separately claimed 80GB of data from Manchester Airports Group. ATF confirmed a major ransomware incident in late August.