zHealthEHR — Practice Management Software for Chiropractic & Wellness Clinics Listed by kazu Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

zHealthEHR, a cloud-based electronic health record and practice management platform serving chiropractic and wellness clinics, was listed by the ransomware group kazu on or around January 26, 2026. The listing indicates that internal files were exfiltrated during a ransomware attack. The number of individuals affected remains unknown, and no further details on the scope or confirmation of the data release have been made public.

What happened

The incident centers on a ransomware operation in which files were removed from zHealthEHR systems before encryption occurred. The group kazu added the organization to its leak site, a step that publicly signals the exfiltration of internal files. No information has been released on the date the intrusion began, the volume of data taken, or whether the files were later published. The organization has not issued a statement detailing its response or the technical method used to gain access.

The group behind it: kazu

kazu is a ransomware operator that follows the common pattern of encrypting victim systems and removing copies of data for leverage. Groups of this type typically maintain a site where they list organizations from which they claim to have obtained files, using the listing to pressure targets into payment. Public reporting on kazu has documented similar activity against other entities in prior incidents, though each listing remains an unverified claim until independently confirmed by the victim or investigators.

About zHealthEHR

zHealthEHR provides a subscription-based platform that integrates clinical documentation, scheduling, billing, patient intake, and automated reminders for small and mid-size chiropractic and wellness practices. The system is designed to handle routine administrative tasks within a single interface, reducing the need for separate tools. Organizations in this sector routinely process records that include patient health information, insurance details, and operational documents, making them attractive targets for data theft.

What was likely exposed

The only data category named in connection with the incident is internal files removed during the ransomware attack. The precise contents of those files have not been disclosed. Organizations that operate electronic health record platforms commonly store patient identifiers, clinical notes, billing records, and administrative documents; however, whether any of these categories were among the exfiltrated material remains unconfirmed.

Why it matters

Health-related records carry long-term value for identity theft, insurance fraud, and targeted scams because they contain stable personal details that are difficult to change. For the clinics that rely on the platform, any prolonged disruption or subsequent misuse of operational files can affect daily scheduling and billing processes. Individuals whose information may have been held in the affected systems face the standard risks associated with exposure of sensitive records, even when the exact scope is still unknown.

What to do if you're exposed

Review statements or notices issued by zHealthEHR or your clinic for any instructions on monitoring accounts or resetting credentials. Place a fraud alert with one of the major credit bureaus and check health insurance explanations of benefits for unexpected claims. Individuals can also run a free exposure scan of their email address against known breach data sets to determine whether their information has appeared in previously published collections.

AICompiled with AI assistance from public sources and published under our editorial standards.