Cognitive Health Technologies discloses data breach affecting 49,467 people
Cognitive Health Technologies says an intruder accessed files with health data of 49,467 people, so check insurance statements for unfamiliar claims.
- Published
- Ecosystem
- Enterprise software
- Exploitation
- No, the company says no misuse of the data has been identified, and the entry point is not confirmed
What happened
According to HIPAA Journal, Cognitive Health Technologies LLC has disclosed a data security incident involving the protected health information of 49,467 individuals. The company is a New York-based healthcare technology and IT consulting company. HIPAA Journal summarises the company’s substitute data breach notice, and the details below come from that notice. They have not been independently verified.
According to the notice, the company identified suspicious network activity on April 27, 2026, and started a forensic investigation. The company says the investigation confirmed that an unauthorized third party accessed its network between February 5, 2026, and April 28, 2026. The company says files and folders containing protected health information were accessed and acquired during that period (HIPAA Journal).
The company says the compromised information included the following (HIPAA Journal):
- names
- dates of birth
- health insurance information
- medical histories
- treatment information
The company states that no misuse of the information has been identified. It also says it has reviewed its security policies and added measures to protect against similar incidents.
The following details are not confirmed:
- how the intruder got in
- whether ransomware was involved
- which client organisations’ patients are affected
- whether any group has claimed responsibility
- whether individual notification letters have been sent
Am I affected?
- You may be affected if your health information was handled by Cognitive Health Technologies. The company’s disclosure counts 49,467 individuals (HIPAA Journal).
- The source does not list which healthcare providers or clients used the company’s services. Whether your provider is involved is not confirmed.
- Social Security numbers are not listed among the compromised data types in the source.
What to do now
- If you receive a notification letter from the company, follow the instructions in it and keep it for your records.
- Review explanation of benefits and health insurance statements for treatment or claims you do not recognise. This is general guidance, not from the source.
- If you are a healthcare organisation that works with Cognitive Health Technologies, contact the company directly to find out whether your patients’ data was involved. The source does not name affected clients.