All About Women’s Care Data Breach (2026)
The 2026 All About Women’s Care data breach is the event in which the organization identified unusual activity in an employee VPN account on April 9, 2026, and confirmed unauthorized network access.
The affected total is not confirmed, so severity cannot be determined from a record count alone.
Exposed Data Types
8 sensitive14- Clinical information
- Treatment information
- Laboratory results
- Prescription information
- Provider information
- Health-insurance information
- Medical documents
- Ultrasound images
- Names
- Dates of birth
- Social security numbers
- Driver’s licence numbers
- Other government-identification numbers
- Passport or identification-document copies
About This Breach
Its review found that some files were accessed or acquired; the initial-access date and exfiltration of every file are not confirmed.
HHS OCR reports 12,000 affected people. This is a regulatory notification population, not searchable emails, local dataset rows, or proof that every field occurred together for every person. File review concluded on June 5 and the organization issued notice on June 8; no person or document data is locally imported.
Fields that may vary by person are names, dates of birth, Social security numbers, driver’s-licence or other government-ID numbers, passport or ID-document copies, clinical and treatment information, laboratory results, prescriptions, provider information, health insurance, medical documents, and ultrasound images. Cards, bank accounts, passwords, and biometric data are not reported scope.
The notice does not establish that a person was a patient; received women’s-health or obstetric care; was pregnant; had a particular diagnosis, treatment, prescription, laboratory result, ultrasound, provider, or insurance relationship; had every field co-occur; or experienced misuse or public release. The individual notice and the organization’s current official instructions control person-specific scope and support.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
