Texas Hearing Institute Data Breach: What Houston Should Know

The timeline, the attacker, and what 29,498 families are being told.

The Texas Hearing Institute, a pediatric hearing center in Houston, identified unauthorized access to its network on March 20, 2026. By the time the incident closed, at least 29,498 people were being notified that their names, Social Security numbers, financial information, and medical records may have been taken.

The timeline matters more than any single fact in it. On April 2, 2026, 13 days after detection, the Interlock ransomware group posted the organization to its leak site and claimed 540 GB of stolen internal data. On April 22, 33 days after detection, third-party forensic investigators confirmed that personal information had been accessed. Notification letters did not start arriving until early July, roughly 15 weeks after the intrusion was first spotted.

Affected families were offered 24 months of credit monitoring and identity theft protection. HIPAA Journal, which has tracked the incident since July, reports the confirmed count at 29,498.

Interlock is not a mystery attacker. A July 2025 joint #StopRansomware advisory from CISA, the FBI, HHS, and MS-ISAC laid out the group's playbook: get in through compromised websites and fake browser-fix prompts, steal the data first, then encrypt - with healthcare organizations heavily represented among its victims. That fake-fix entry technique is the same ClickFix social engineering we broke down last month. The playbook was public 8 months before this breach.

The Texas Hearing Institute is not an isolated case. It is the third local provider tied to a cyber incident since February.

Between February and August 2026, 3 Houston-area healthcare providers were tied to cyber incidents: the Texas Hearing Institute, Houston Eye Associates, and Lymphedema Therapy Specialists. None is a hospital system. All 3 are the specialty and outpatient providers that make up most of Houston's medical economy.

One caveat belongs on the record: the Houston Eye Associates claim comes from a criminal leak site and the practice has not confirmed a breach. Criminal claims are marketing until the organization or a regulator confirms them. The other 2 incidents are confirmed by the providers themselves.

Houston makes this math worse, not better. The Texas Medical Center's gravity means the metro is dense with independent specialty practices - and IBM's 2026 Cost of a Data Breach Report priced the average healthcare breach at $6.64 million, once again the most expensive industry in the study. High data value plus thin defenses is exactly what a ransomware affiliate's target list optimizes for.

We see the pattern from the defense side too. When CinchOps assesses Houston-area practices, the recurring findings are the same short list: shared logins on the EHR, no MFA on email, backups that sit on the same network they are supposed to rescue, and a firewall nobody has patched since installation. Not exotic gaps. Boring ones.

Five moves that change the outcome, plus the 2 notification clocks every Texas practice should already understand.

A Houston medical practice's best week to prepare for a breach is any week before it happens. The 5 highest-value moves are MFA everywhere, tested off-network backups, network segmentation, edge patching, and a 1-hour incident tabletop - in that order.

• Turn on MFA everywhere, starting with email and the EHR. Interlock's playbook runs on stolen credentials; MFA is the cheapest thing that breaks it.
• Back up like the network is already lost. Keep a copy off-network and outside the building - CinchOps replicates client backups outside the Gulf Coast flood zone - and restore-test it. A backup you have never restored is a hope, not a plan.
• Segment the network. The EHR and imaging systems should not share a flat network with the front-desk PC that browses the web. Segmentation is what turns an infection into an incident instead of a shutdown.
• Patch the edge first. Firewalls, VPN appliances, and remote-access tools are where ransomware crews walk in. If the appliance is past end of life, replace it - attackers keep lists.
• Run a 1-hour tabletop. Decide now who calls the cyber insurance carrier, who calls counsel, and who counts affected records. The Texas Hearing Institute needed 33 days just to confirm what was accessed.

In 30 years doing this, I have never met a practice that regretted a restore test or an hour of tabletop planning. I have watched plenty regret skipping both - usually in the same month they learned what breach counsel costs by the hour.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area. CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10 to 200 employees.

• Through managed IT support, we handle the patching, monitoring, and day-to-day help desk work practices rarely have time for - with responses in under 15 minutes.
• Our cybersecurity services cover the exact gaps this breach exposed: MFA rollout, endpoint detection, email protection, and network segmentation.
• Business continuity and disaster recovery planning keeps restore-tested backups replicated outside the Gulf Coast flood zone, so one intrusion or one hurricane cannot take both your systems and your fallback.
• We support practices across the metro through IT support in Houston and IT support in Katy.

CISA published Interlock's playbook in July 2025. This breach started 8 months later. That gap is closable, and closing it costs a flat monthly rate, not $6.64 million. If your practice cannot say with certainty that MFA is on, backups restore, and the EHR sits on its own network segment, talk to CinchOps before the next leak-site post has a Houston address on it.