"Certain information maintained on the company’s servers was accessed and exfiltrated by an unauthorized third party, including patient and employee, credentialed provider, business and financial information that is private and/or confidential," Nutex Health told the SEC on August 31 — and added that "the third party has threatened to post such information externally."
Nutex Health SEC filing and immediate disclosures
On August 31 Nutex Health, a Texas-based healthcare provider that owns and operates more than 27 facilities in 12 states, disclosed in an SEC Form 8-K that an unauthorized actor accessed and removed data from its systems. The company first informed the SEC on August 24 that it had detected unauthorized activity involving data stored on its computer network. Nutex said it is continuing to assess the incident and will monitor for any online leaks.
What was taken and how the company is responding
Nutex named categories of information it believes were accessed and exfiltrated: patient and employee data, credentialed provider information, and business and financial information described as private and/or confidential. The filing states Nutex will notify all impacted patients of the data breach. As of the filing, Nutex reported it had not identified any material impact on its business operations or financial reporting systems arising from the incident.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleThe Gentlemen ransomware gang claims responsibility; wider threat environment
The ransomware-as-a-service operator known as The Gentlemen has reportedly listed Nutex on its dark web portal and claimed responsibility. According to reporting cited in Nutex’s disclosure, The Gentlemen was first observed in mid-2025 and its activity levels "exploded in 2026 amid rapid affiliate growth." An analysis published by Sophos on September 1 described The Gentlemen affiliates as opportunistic and noted that healthcare accounts for 9% of their victims, second only to manufacturing at 10%.
Sophos’s assessment also described common initial-access techniques used by affiliates: exploiting vulnerabilities in firewalls and abusing VPN services to gain entry to victim environments. The Nutex disclosure sits against a string of high-profile healthcare-related incidents: on August 28 McKesson confirmed a breach affecting customers in its Oncology & Multispecialty and Medical‑Surgical business units. Reports suggested as many as 284 million records may have been compromised at McKesson and noted a $55 million ransom demand; the group ShinyHunters posted an entry for McKesson on its leak site, claiming to have compromised hundreds of millions of records.
Legal actions and third‑party investigations
Following Nutex’s initial SEC notice, a class action complaint was filed on August 27 on behalf of individuals whose personally identifiable information and/or protected health information was accessed and/or acquired. Nutex stated it is unable at this stage to predict the outcome of the litigation or estimate the potential impact on its business strategy, operations, financial condition, results of operations or the trading price of its common stock.
Separately, legal firm Edelson Lechtzin LLP said on September 1 that it is investigating the Nutex breach and is offering to evaluate affected individuals’ rights at no cost.
What this means for Patients, Security teams, and Legal representatives
- Patients: Nutex has confirmed it will notify all impacted patients. Individuals should expect direct notification and may be offered information on what categories of their personal or health data were involved.
- Security teams and technologists: Nutex’s statement that it continues to assess whether additional data was stolen and will monitor for online leaks signals ongoing forensic work and threat-hunting; defenders will be watching for any public data postings tied to The Gentlemen or other actors.
- Legal representatives and litigants: The class action filed on August 27 and Edelson Lechtzin LLP’s separate inquiry indicate parallel legal paths. Nutex’s inability to estimate litigation outcomes or financial impact leaves these matters unsettled and likely to be central to upcoming legal and disclosure filings.
Nutex served nearly 100,000 patients during the first six months of 2026, a fact the company disclosed alongside its facilities footprint; however, Nutex has not reported a material operational disruption so far. With The Gentlemen publicly listing victims and other groups active in the same period claiming large-scale compromises, the immediate questions are concrete and narrow: will additional Nutex data appear on public leak sites, what further categories of information — if any — are shown to have been exfiltrated, and how the pending litigation will unfold. For now Nutex says it will continue its assessment, notify affected patients, and monitor for leaks online — steps that will determine the next measurable developments in the case.
