HealthStream, Inc. disclosed a cybersecurity incident in which an unauthorized third party accessed and exfiltrated files from its corporate file server. The breach affected employee information, billing data for certain customers and vendors, and corporate legal records. Approximately 75 credentialing customers were impacted due to data copied for conversion and troubleshooting purposes; these clients have been notified. No customer-facing systems, protected health information (HIPAA), or encryption-related damage was identified, and operations continued without interruption. The company incurred remediation expenses but does not expect a material adverse impact on business or financial results. HealthStream operates in the healthcare education and workforce development industry.
