Cumberland County Hospital Data Breach Exposes 36,659 Americans' Records

A cybersecurity incident has potentially exposed the sensitive personal, health, and financial records of 36,659 Americans. The U.S. Department of Health and Human Services Office for Civil Rights reported that this breach occurred at Cumberland County Hospital (CCH) due to a hacking/IT incident.

CCH disclosed that an unidentified attacker infiltrated its systems and stole a wide range of data, including names, dates of birth, addresses, phone numbers, email addresses, ethnicities, Social Security numbers, medications, diagnoses, treatment notes, dates of service, medical record numbers, health plan numbers, claims, and billing records. The breach also compromised the employment data of current and former employees, which may include driver’s licenses, birth certificates, background check records, W-4 and W-2 tax forms, and bank account numbers.

The hospital first detected the unauthorized access on April 3, 2025. Upon discovery, CCH immediately shut down all computers, disabled data sharing connections, contacted law enforcement, and initiated an investigation. Cybersecurity experts determined that the unauthorized access began on February 21, 2025, and continued until April 3, 2025. Notably, the electronic medical records system used by CCH and its partners was not involved or accessed in this incident.

CCH, a Kentucky-based hospital offering outpatient and inpatient healthcare services, promptly notified affected individuals via letters. The hospital also offered free identity monitoring services for 12 months to mitigate potential risks. In response to the breach, CCH's IT team has enhanced the hospital’s security protocols to prevent similar incidents in the future.

This data breach underscores the growing threat of cyberattacks on healthcare institutions, which hold vast amounts of sensitive information. The exposure of such data can lead to identity theft, financial fraud, and other serious consequences for affected individuals. The incident at CCH highlights the need for robust cybersecurity measures to protect patient and employee data from unauthorized access.