Cybersecurity Incidents Impact Thousands Across Three U.S. Healthcare Providers Three healthcare organizations Aitkin County Health and Human Services (Minnesota), Decatur Diagnostic Laboratory (Alabama), and Gem State Dermatology (Idaho) have reported data breaches affecting tens of thousands of individuals, with varying causes and exposed data types. ### Aitkin County Health and Human Services (Minnesota) On April 8, 2026, Aitkin County HHS detected a phishing attack after an employee email account began sending malicious messages. An investigation revealed unauthorized access to three employee email accounts between April 7–8, 2026, with data from one account downloaded by the attacker. The breach exposed protected health information (PHI) of 83,114 individuals, including: - Names, addresses, dates of birth, and Social Security numbers - Medical records, diagnoses, treatment details, and insurance claims - Case identifiers, provider names, and medication histories The county has since reset passwords, enhanced employee training, updated email retention policies, and is evaluating additional cybersecurity measures to prevent future incidents. ### Decatur Diagnostic Laboratory (Alabama) Decatur Diagnostic Laboratory reported a hacking incident with data exfiltration to the HHS’ Office for Civil Rights, though the exact timeline remains unclear. The breach exposed names paired with sensitive data, such as: - Dates of birth, Social Security numbers, and driver’s license numbers - Medical record numbers and patient codes While not confirmed as a ransomware attack, the LockBit 5 ransomware group claimed responsibility, alleging data theft and listing the lab on its dark web leak site. Affected individuals were advised to monitor for identity theft over the next 24 months, though no credit monitoring services were offered. ### Gem State Dermatology (Idaho) In a rare improper disposal incident, Gem State Dermatology discovered patient documents and microscope slides containing PHI in a dumpster three miles from its Boise practice on July 8, 2026. The discarded materials included: - Billing statements with medical and personal data - Thousands of microscope slides, likely containing biological samples The practice has retrieved the materials and launched an internal investigation but has not yet determined the number of affected patients. These incidents highlight ongoing vulnerabilities in healthcare data security, from phishing and hacking to physical disposal failures, underscoring the need for robust safeguards across digital and operational fronts.