Nutex Health first detected suspicious network activity on August 24, 2026, later confirming that an unauthorized third party bypassed security to exfiltrate proprietary files. The company, which operates 28 facilities across 12 states, escalated the event to a material cybersecurity incident on August 31. The attackers have since threatened to publish the stolen data, a tactic known as double extortion that places victims at severe risk of both financial and medical identity theft.

SEC filings indicate the compromised data includes patient records, employee details, and sensitive business information. A class action lawsuit has already been initiated against the firm, while Edelson Lechtzin LLP is currently evaluating further legal claims on behalf of those affected. Affected individuals are advised to secure their credit files via freezes at Equifax, Experian, and TransUnion, and to monitor medical statements for unauthorized services. The law firm is offering confidential consultations for those concerned about their exposure in the wake of the incident.