A hacking group identified as FulcrumSec reportedly exploited an unpatched vulnerability to access an unencrypted, public-facing storage bucket belonging to Lena Health, an AI-powered care-coordination platform, exposing protected health information for roughly 2,100 patients, most from Houston Methodist. Exposed data reportedly included names, dates of birth, phone numbers, medical record numbers, recorded phone calls, hospital discharge documents, and API keys/staff credentials. Sources disclosing the breach gave inconsistent dates for when the underlying intrusion occurred; this post uses the breach-tracking site’s publication date.