Coos County Family Health Services, a New Hampshire-based healthcare provider, experienced a cybersecurity incident resulting in the unauthorized access of personally identifiable information (PII) and protected health information (PHI) of approximately 40,000 individuals. The compromised data included names, dates of birth, contact details, Social Security numbers, and sensitive health records. The breach exposed patients to risks such as identity theft, financial fraud, and medical fraud, given the highly sensitive nature of the leaked information. The incident prompted a legal investigation by Lynch Carpenter, LLP, a national class-action law firm, which is assessing claims for potential compensation on behalf of affected individuals. The breach underscores significant vulnerabilities in the healthcare provider’s data security measures, raising concerns over compliance with HIPAA and other data protection regulations. The exposure of SSNs and PHI amplifies the severity, as such data can be exploited for long-term fraudulent activities, severely impacting the victims' financial and personal well-being.

Coos County Family Health Services, a New Hampshire-based healthcare provider, suffered a ransomware attack in July 2025, where an unauthorized actor infiltrated its internal network and exfiltrated sensitive patient data. The breach exposed personally identifiable information (PII) and protected health information (PHI)—including names, dates of birth, contact details, Social Security numbers, medical IDs, and clinical records—of 40,185 current and former patients. The Run Some Wares ransomware group claimed responsibility, posting stolen data on a dark web forum. The incident triggered regulatory disclosures to the U.S. Department of Health and Human Services, as well as notifications to affected individuals in New Hampshire, Maine (1,222 residents), and Massachusetts (365 residents). The organization responded by securing systems, engaging law enforcement, and offering 12 months of free credit monitoring and identity protection services to victims. The breach poses risks of identity theft, financial fraud, and targeted phishing attacks leveraging exposed health and personal data.

The Maine Office of the Attorney General disclosed a data breach affecting Coos Health & Wellness (CHW) on December 16, 2023, stemming from an unauthorized network access (hacking) incident that occurred on April 28, 2023. The breach compromised sensitive personal and medical data of at least one Maine resident, including Social Security numbers and medical information. Such exposed data heightens risks of identity theft, financial fraud, and misuse of protected health information (PHI). In response, CHW has provided 12 months of identity theft protection services via IDX to mitigate potential harm. The incident underscores vulnerabilities in healthcare cybersecurity, where even limited exposures can have severe repercussions for individuals due to the sensitivity of the leaked data. The breach’s scope—though reported as affecting a single resident—raises concerns about broader systemic weaknesses, potential underreporting, or targeted exploitation of high-value personal records.

Coös County Family Health Services (CCFHS), a New Hampshire-based community healthcare provider, suffered a ransomware attack in July 2025, confirmed by the Run Some Wares group in August. The breach exposed 40,185 individuals' sensitive data, including names, dates of birth, contact details, Social Security numbers, medical IDs, and medical records. The attack began with suspicious activity on July 9, 2025, leading to unauthorized server access, where data was potentially viewed or copied. The incident follows a previous ransomware attack in September 2021, highlighting recurring vulnerabilities. While CCFHS has not officially confirmed the ransomware claim, it is offering 12 months of free credit monitoring to affected individuals. The breach aligns with a broader trend of rising ransomware attacks on US healthcare, with 6.2 million records compromised across 63 confirmed incidents in 2025 alone. The attack disrupted operations, risked patient privacy, and reinforced the sector’s susceptibility to data theft and system encryption by cybercriminal groups.