Cottage Hospital Data Breach Exposes Sensitive Patient and Employee Information Cottage Hospital recently disclosed a data breach in which unauthorized access to its computer network may have compromised sensitive personal and health-related information. The incident came to light on December 8, 2025, when the hospital detected unauthorized activity on its systems. An investigation revealed that an unauthorized third party accessed files containing protected data between October 14 and October 21, 2025. The exposed information varies by individual but includes: - Personal identifiers (names, Social Security numbers, driver’s license numbers, dates of birth) - Financial details (bank account information) - Contact information - Health data (insurance details, medical records, treatment history, provider names, and internal patient IDs) Following the breach, Cottage Hospital posted a notice on its website and began mailing notifications to affected individuals on February 6, 2026. As part of the response, the hospital is offering complimentary credit monitoring services to impacted parties and providing details on the specific data exposed. The breach notice, including additional information, is available on the hospital’s website.

The California Office of the Attorney General reported that Cottage Health experienced a data breach involving the exposure of Protected Health Information (PHI) affecting approximately 11,000 patients. The breach occurred between October 26 and November 8, 2015, when patient information was inadvertently exposed to the internet. Specific types of compromised information included patient names, addresses, social security numbers, and limited medical information, but not financial information.

On December 11, 2013, the California Office of the Attorney General reported a data breach involving Cottage Health System. The breach involved the exposure of patient names, addresses, dates of birth, medical record numbers, account numbers, and health information, although no financial information was compromised.