Nutex discloses stolen patient data breach to SEC, says it is still assessing what was taken
The Gentlemen gave the Houston hospital operator nine days to pay after an August 31 filing confirmed patient, employee and provider files were taken, and a class action had already landed on August 27.
The Watch · Security desk
What happened
- Nutex Health's first SEC filing, on August 24, said only that it had detected unauthorized activity involving data stored on its computer network.
- A second 8-K on August 31 said patient, employee, credentialed provider, business and financial information was accessed and exfiltrated by an unauthorized third party.
- The Gentlemen ransomware group claimed the intrusion the same day, listing the Houston company on its Tor leak site with a threat to publish within nine days.
- A putative class action covering everyone whose personal or protected health information was allegedly taken was filed in Texas on August 27.
- Nutex says it is still assessing whether other data was stolen and has committed to notifying every impacted patient.
Why it matters
- Who's exposed exposure Counting nine days from the August 31 filing puts a publication date around September 9, which means patients may see their records on a leak site before Nutex has finished identifying who they are.
- What it costs cost Litigation arrived four days before the company could name the data categories, so defense spend and discovery start against an investigation that has no scope figure yet.
- What it sets up precedent The Gentlemen charges affiliates only a 3% cut on exfiltration-only jobs, which prices hospital data theft below encryption and removes the outage that usually tells the outside world something happened.
- What it limits constraint Because Nutex cannot estimate litigation outcome or financial impact, the only firm number in circulation belongs to the extortionist, and investors get a disclosure that bounds nothing.
Next story · Security · Oct 6
Gentlemen RaaS affiliate ran his own leak site to pocket the ransoms, CloudSEK saysConfirmed2 publishers
Extortion without encryption leaves the operations line clean. Nutex says it has identified no material impact on its business operations or financial reporting systems to date [8], which is the signature of a theft-only intrusion: nothing stops, and the loss sits entirely in copies that are already off the network. The contrast inside the same gang's victim list is AnMed, the nonprofit medical system whose IT The Gentlemen shut down and whose Facebook account it took over, forcing dozens of facilities to close for several days before AnMed confirmed patient information was stolen [17]. One operator, two very different outage profiles.
Scale sets the notification problem. Nutex runs 27 hospital and outpatient facilities in 12 states and booked $427.2m in the first half of 2026 [9], and it reportedly served nearly 100,000 patients over that same period [10]. If the files taken from its servers track recent care, the letter population is a six-figure exercise, and it cannot begin until the review names individuals.
On the actor, the public record is two different tallies. The Record reports The Gentlemen operating since September 2025 with at least 350 attacks [21]. SecurityWeek dates emergence to mid-2025 and counts more than 580 victims in over 75 countries [22]. Subtract and the gap is 230 victims for the same ransomware-as-a-service brand [23], which is what happens when leak-site posts stand in for a census. The Record also reports experts assessing the group as a spinoff run by a disgruntled former Qilin affiliate, with Russian operators inferred from its ban on targeting CIS countries and its Russian-language forum posts [16]. That is assessment, not confirmation, and Nutex's filing names no group at all [11].
The defensive read comes from Sophos, which published on September 1 that healthcare accounts for 9% of The Gentlemen's victims, second to manufacturing at 10%, and that affiliates typically gain initial access by exploiting firewall vulnerabilities and abusing VPN services [13][14]. No one has published the entry point at Nutex, so internet-facing security appliances and remote access accounts are the working hypothesis rather than a finding. Gambit Security separately reported seeing a Gentlemen affiliate using Claude Code during intrusions at six or more organizations [24].
For hospital groups the sequence Nutex just ran is the one to plan against: an 8-K on detection, a class action three days later, a leak-site countdown, and patient letters last.
What to watch
- Whether The Gentlemen posts Nutex data on or after September 9, and how much of the dump is patient records.
- The first Nutex patient notification and the number attached to it, against the nearly 100,000 patients served in the first half of 2026.
- Whether more firms file after Edelson Lechtzin LLP's September 1 announcement that it is investigating the breach.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption62
- Hype gap+8
- Incentives76
- Confidence72
Perspective Coverage
3 publishers- Builder
- Builder 15%
- Operator
- Operator 57%
- Investor
- Investor 28%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Nutex Health disclosed in an 8-K filing to the SEC on August 31 that it believes information on its servers, including patient, employee, credentialed provider, business and financial information, was accessed and exfiltrated by an unauthorized third party.
- [2]
Nutex said the third party has threatened to post the stolen information externally.
- [3]
A class action complaint was filed in Texas on August 27 on behalf of a putative class of all individuals whose personally identifiable information and/or protected health information was allegedly accessed or acquired in connection with the incident.
- [4]
Nutex said it is unable to predict the outcome of the litigation or estimate the potential impact of the incident on its business strategy, operations, financial condition, results of operations or the trading price of its common stock.
- [5]
The Gentlemen ransomware group claimed responsibility on Monday, the same day as the filing, adding the Houston-based company to its Tor leak site and threatening to leak allegedly stolen data within nine days.
- [6]
Nutex first informed the SEC on August 24 that it had detected unauthorized activity involving data stored on its computer network.
- [7]
In its initial August 24 disclosure Nutex told investors it had hired cybersecurity experts to help address the attack.
- [8]
Nutex said that to date it has not identified any material impact on its business operations or financial reporting systems arising from the incident.
- [9]
Nutex earned $427.2 million in the first half of 2026 through its operation of 27 hospital and outpatient facilities in 12 states, and also controls a primary care physician network.
- [10]
Nutex reportedly served nearly 100,000 patients during the first six months of 2026.
- [11]
Nutex's 8-K filing did not specify the cybercrime group, and Nutex did not respond to requests for comment.
- [12]
Nutex said it is continuing to assess whether any other data was stolen, will monitor for leaks online, and confirmed it will notify all impacted patients.
- [13]
An analysis of The Gentlemen published by Sophos on September 1 found healthcare is the group's second most commonly targeted industry at 9% of victims, behind manufacturing at 10%.
- [14]
The Gentlemen affiliates typically rely on exploiting vulnerabilities in firewalls and abusing VPN services to gain initial access to victim environments.
- [15]
The Gentlemen allows affiliates to conduct both ransomware attacks and data exfiltration-only incidents, taking only a 3% cut of ransoms from exfiltration-only jobs.
- [16]
Experts say The Gentlemen was created by a disgruntled former affiliate of the Qilin ransomware operation and believe the group is based in Russia because it prohibits members from attacking CIS countries and its cybercriminal forum posts are written in Russian.
- [17]
The Gentlemen shut down the IT system of nonprofit medical system AnMed and took over its Facebook account, forcing AnMed to shutter dozens of facilities for a number of days before it confirmed patient information was stolen.
- [18]
Legal firm Edelson Lechtzin LLP said on September 1 that it is separately investigating the Nutex data breach and is offering to evaluate affected individuals' rights at no cost.
- [19]
The nine-day leak threat, counted from the August 31 filing date, points to publication on or about September 9.
- [20]
The class action was filed four days before the company's filing that identified the categories of exfiltrated data, and three days after its first disclosure of unauthorized activity.
- [21]
The Record reports The Gentlemen has operated since September 2025 and has launched at least 350 attacks since emerging.
- [22]
SecurityWeek reports The Gentlemen, also known as Storm-2697, emerged in mid-2025 and has made over 580 victims in more than 75 countries, engaging in double extortion.
- [23]
The two published victim counts for The Gentlemen differ by 230.
- [24]
Gambit Security said it saw an affiliate of The Gentlemen using Claude Code during intrusions into at least six organizations.
Sources
3 independent publishers whose own reporting we read for this story.
- infosecurity-magazine.comNutex Health Says Patient Data Stolen, Hackers Threaten Leak
1 article · September 2, 2026
- securityweek.comRansomware Gang Claims Nutex Health Data Breach
1 article · September 1, 2026
- therecord.mediaHealthcare facilities operator Nutex says patient, employee data stolen in August incident
1 article · September 1, 2026
Topics and entities
Topics
Entities
- Sophos
- SEC
- Edelson Lechtzin LLP
- Claude Code
- Qilin
- The Gentlemen
- Dragos
- Gambit Security