INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Lena AI Health Breach Exposes Houston Methodist Patients' Medical Info

| 2026-01-28 18:46 CRITICAL LOW AI-ENABLED ATTACK · AUTONOMOUS DATA BREACH
JSON
Executive Summary
AI-generated
On June 1, 2025, Serviceaide, a provider of AI-powered healthcare software, suffered a data breach that exposed the protected health information of at least six federal class-action lawsuits' patients. The breach was caused by an unsecured database and involved 483,000 patients from Catholic Health in Buffalo, New York. A recent hacking forum listing reveals another breach involving "digital helper" Lena Health, which stored 2,134 patients' complete PHI in an unencrypted database export sitting in a public-facing S3 bucket. The attack was carried out via a major vulnerability that went public in early December, and the attackers were contacted by FulcrumSec on January 10 but had not responded as of January 15.
Technical Mitigations AI-generated
• Patch the major vulnerability in early December, specifically addressing the unsecured database export sitting in a public-facing S3 bucket. • Block or hunt for API keys and staff login credentials to prevent unauthorized access to sensitive data. • Use a technique such as file integrity monitoring (FIM) to detect anomalies in PHI storage on vulnerable servers accessible by the entire internet.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 1 IoCs Create Free Account
da•••••.net
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope healthhealth
Incident Timeline
‎2026/01/28
Threat actors exploited vulnerabilities in Lena Health's AI-powered healthcare software to expose sensitive medical information of approximately 2,134 unique patients affiliated with Houston Methodist.
data_breach 19,542 recorded phone calls
…st, the bucket contained: – 2,134 unique patients with full names, dates of birth, phone numbers, and other PHI data – 19,542 recorded phone calls with patients discussing their health — most with full transcriptions – 68 hospital discharg…
data_breach 1,380 phone numbers
…documents with deeply intimate information no patient would ever consent to having stored by a startup with flimsy security – 1,380 phone numbers linking directly to vulnerable, elderly patients and API keys, staff login credentials, and more!
Tactical Metrics
Metrics
data_breach
19,542
Recorded Phone Calls
…st, the bucket contained: – 2,134 unique patients with full names, dates of birth, phone numbers, and other PHI data – 19,542 recorded phone calls with patients discussing their health — most with full transcriptions – 68 hospital discharg…
Metrics
data_breach
1,380
Phone Numbers
…documents with deeply intimate information no patient would ever consent to having stored by a startup with flimsy security – 1,380 phone numbers linking directly to vulnerable, elderly patients and API keys, staff login credentials, and more!
Intelligence Sources
Data Breaches 2026-01-28