Hipaajournal Ransomware Attack on Paylogix Exposes Data of 41K Individuals
Article Content
- •Paylogix breach affects 41,739 individuals due to ransomware.
- •Unauthorized access occurred from November 13 to November 18, 2025.
- •Akira ransomware group claims to have exfiltrated 185 GB of data.
Paylogix LLC reported a ransomware incident affecting the protected health information of 41,739 individuals. The breach occurred between November 13 and November 18, 2025, when an unauthorized third party accessed its network. Data compromised includes Social Security numbers, dates of birth, and health insurance information. The Akira ransomware group claimed responsibility, stating they exfiltrated 185 GB of data. Additionally, the Kenaitze Indian Tribe and the Center for Bone and Joint Surgery of the Palm Beaches reported breaches affecting 9,319 and 5,461 individuals, respectively. The Kenaitze incident was detected on July 27, 2026, while the Center for Bone and Joint Surgery identified suspicious activity on the same date. Notifications to affected individuals have begun, with the Kenaitze Tribe starting on September 25, 2026. The investigation into the Paylogix breach is ongoing.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track Akira and Center For Bone And Joint Surgery Of The Palm Beaches in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What types of data were exposed?
How many individuals are affected?
What actions should affected individuals take?
Continue Reading
Attackers Exploit MFA Gaps in SonicWall VPN Access On August 4, 2026, an Akira ransomware affiliate successfully accessed a SonicWall SSL VPN by spraying passwords, exploiting the lack of multi-factor authentication (MFA). After gaining access, the attacker used RDP to reach the domain controller and enumerate Active Directory, although the ransomware deployment… 
Huntress Analyzes Akira Ransomware Attack After EDR Failure In September 2026, Huntress deployed its agent at an organization already compromised by Akira ransomware. The post-compromise installation meant crucial EDR telemetry was missing, hindering initial access insights. Researchers reconstructed the attack using Windows Event Logs, Registry artifacts, and Akira log files.…