Institute of Culinary Education, SSMC and Quantum Health Disclose Breaches

Key Takeaways

• Three newly announced incidents exposed combinations of identity, insurance, and medical information.
• The SSMC incident involved a third-party vendor network, highlighting persistent supply-chain exposure.
• Affected individuals face risks ranging from identity theft to highly tailored medical and insurance fraud.

The Institute of Culinary Education, Silver Summit Medical Corporation dba Digestive Disease Center and Heart Vascular & Leg Center (“SSMC”), and Quantum Health, Inc. are notifying individuals about separate data breaches involving sensitive personal information.

Although the incidents occurred at different times, their disclosure this week gives security and risk leaders another reminder that stolen data does not need to come from a single massive intrusion to create substantial exposure. Education records, identity documents, health information, and contact details can each support different forms of fraud.

The Institute of Culinary Education said its incident occurred on or around May 5, 2025. An unauthorized threat actor accessed certain systems and copied files related to current and former students, along with other individuals. Potentially affected information includes names, Social Security numbers, dates of birth, driver’s license numbers, and U.S. alien registration numbers.

That combination is particularly sensitive because several of those data points are difficult or impossible for an individual to change. A password can be reset. A Social Security number, birth date, or immigration identifier creates a much longer-lived problem. Criminals can also combine the records with information gathered elsewhere to make identity-verification attempts appear more convincing.

SSMC experienced a different type of exposure. Between November 27, 2025, and November 30, 2025, a third party accessed the network of one of SSMC’s third-party vendors. Personal or protected health information was acquired without authorization, with potentially compromised data including names, Social Security numbers, and other sensitive information.

Outsourcing a business process does not eliminate the associated security risk; it redistributes it. Vendor access, subcontractor relationships, data-retention practices, and incident-notification obligations can all affect how quickly an organization understands and contains an event.

The broader numbers reinforce that concern. The Verizon 2025 DBIR found that third-party involvement doubled to 30% of breaches, while credential abuse remained the leading initial access method at 22%. Ransomware appeared in 44% of breaches. The disclosures do not establish that ransomware or stolen credentials caused these particular incidents, but the findings show why supplier controls and identity security remain prominent board-level issues.

Quantum Health, Inc. reported that an unauthorized party accessed and acquired files from certain Quantum Health systems between May 29 and June 1, 2026. The potentially compromised records are extensive: names, dates of birth, email and physical addresses, telephone numbers, demographic details, Social Security numbers, health insurance information, and medical information.

The medical data may include treatment details, diagnoses, prescriptions, provider names, and dates of service. That depth can enable more than conventional identity theft. It may support insurance fraud, convincing phishing messages, fraudulent billing, or social-engineering attempts built around real medical events. How many recipients would question an email that correctly references their provider and a recent treatment date?

The disclosures arrive amid a high-volume breach environment. The ITRC 2025 Annual Breach Report tracked 3,322 U.S. data compromise events in 2025, the highest annual total on record and 79% above 2020. Healthcare accounted for 534 compromises, behind financial services at 739 but ahead of many other industries. Organizations issued approximately 278.8 million victim notices in 2025, down from 1.37 billion in 2024, indicating fewer exceptionally large events but more frequent targeted incidents.

Costs remain uneven as well. Research summarized from IBM’s 2025 breach findings placed the average global breach cost at $4.44 million, while the U.S. average reached $10.22 million. Healthcare was the costliest U.S. sector at $7.42 million.

For businesses, the practical response includes reviewing what sensitive data is retained, restricting privileged and vendor access, testing notification workflows, and confirming that contracts address incident reporting. For people receiving notices, account monitoring, credit freezes, password changes, and scrutiny of medical and insurance statements can reduce exposure. Compensation eligibility, meanwhile, depends on the facts, applicable law, and documented harm rather than receipt of a notice alone.