zHealthEHR — Practice Management Software for Chiropractic & Wellness Clinics Listed by Kazu Ransomware Group

On January 26, 2026, the zHealthEHR platform appeared on the leak site of the kazu ransomware group. The company provides cloud-based electronic health records and practice management software used by chiropractors and wellness clinics across the United States. Internal files were allegedly exfiltrated during a ransomware attack, exposing data that belongs to the clinics, their staff, and ultimately the patients whose records live inside the system.

What Public Reporting Shows

Public reporting indicates that kazu listed zHealthEHR on its leak site and claimed to have stolen internal files. The platform handles clinical documentation, appointment scheduling, patient intake forms, billing records, payment details, and automated patient reminders. Because zHealthEHR operates on a subscription model for small to mid-size practices, the stolen data likely includes both business documents and sensitive patient health information. Exact victim counts and the full volume of records remain unconfirmed, but the presence of the company on a ransomware leak site states that attackers successfully accessed and removed data.

Why This Matters for You and Your Family

If you or anyone in your family sees a chiropractor, physical therapist, or wellness provider who uses zHealthEHR, your personal health details, contact information, and possibly payment records may now sit in an attacker’s hands. Health data is especially damaging when leaked because it can be used for insurance fraud, identity theft, or targeted scams that reference your medical history. Even if you never signed up for the service yourself, the clinic’s breach puts your information at risk. Families often share the same providers, which means one incident can quietly expose parents, children, and grandparents at the same time.

The Doxxing and Identity-Chain Implications

Health records rarely exist in isolation. They frequently contain email addresses, phone numbers, home addresses, dates of birth, and insurance IDs. Attackers combine these details with information from other breaches to build detailed profiles. A single leaked patient intake form can link your clinical notes to your social-media handles, children’s school records, or gaming usernames. Once those connections are made, harassment, blackmail, or account takeovers become far easier. Credential leaks like this one routinely cascade into gaming account compromises, especially for families where children use the same email address or password patterns across apps and websites.