Incident Types: The types of cybersecurity incidents that have occurred include Breach.

Detection and Response: The company detects and responds to cybersecurity incidents through an toll free response line with 877-580-4384 (available mon-fri, 8 a.m. to 5 p.m. ct), public disclosure with disclosed to u.s. department of health and human services on 2025-09-12, customer advisories with notices sent to affected individuals with recommended actions (e.g., credit monitoring, fraud alerts), and incident response plan activated with yes, and communication strategy with posted notice on website and mailed data breach notification letters..

Common Attack Types: The most common types of attacks the company has faced is Breach.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Employee email accounts.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Full Name, Address, Date Of Birth, Social Security Number, Date(S) Of Service, Telephone Numbers, Medical Information, , Name, Social Security Number, Address, Date Of Birth, Driver’S License Number, Other Government Issued Identification Number, Payment Card Information, Financial Account Information, Medical Information (Billing/Claims Information, Diagnoses Code, Doctor’S Name, Medical Record Number, Mental Or Physical Condition/Treatment, Medical Device/Serial Number, Biometric Data, Prescription Information, Disability Information, Treatment Location, Patient Id/Account Number, Beneficiary Number), Health Insurance Information (Subscriber Member Number, Group/Plan Number, Policy Number, Beneficiary Number, Medicare/Medicaid Id) and .

Incident Response Plan: The company's incident response plan is described as Yes.

Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through Potential class-action lawsuit (investigated by Shamis & Gentile P.A.).

Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Watch for unusual medical bills or insurance statements, Contact the hospital's toll-free response line (877-580-4384) for questions, Review communications from Saint Anthony Hospital and retain copies, Monitor credit reports and financial accounts for suspicious activity, Providing affected individuals with 24 months of complimentary credit monitoring services, Place a fraud alert or security freeze on credit files with Equifax, Experian and and TransUnion.

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Shamis & Gentile P.A. Investigation Notice, and Source: St. Anthony Breach Notice.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Posted notice on website and mailed data breach notification letters.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Affected individuals were notified with recommended actions (e.g., credit monitoring, fraud alerts, and reporting suspicious activity). and Data breach notification letters mailed to impacted individuals.

Last Attacking Group: The attacking group in the last incident were an Unauthorized Party (Unknown) and Unauthorized third party.

Most Recent Incident Detected: The most recent incident detected was on 2025-02-06.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-09-12.

Most Significant Data Compromised: The most significant data compromised in an incident were PII, PHI, and Sensitive personal identifiable information and protected health information.

Most Significant System Affected: The most significant system affected in an incident was Employee Email Accounts and .

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Sensitive personal identifiable information and protected health information, PHI and PII.

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 6.7K.

Most Significant Legal Action: The most significant legal action taken for a regulatory violation was Potential class-action lawsuit (investigated by Shamis & Gentile P.A.).

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Watch for unusual medical bills or insurance statements, Contact the hospital's toll-free response line (877-580-4384) for questions, Review communications from Saint Anthony Hospital and retain copies, Monitor credit reports and financial accounts for suspicious activity, Providing affected individuals with 24 months of complimentary credit monitoring services, Place a fraud alert or security freeze on credit files with Equifax, Experian and and TransUnion.

Most Recent Source: The most recent source of information about an incident are Shamis & Gentile P.A. Investigation Notice and St. Anthony Breach Notice.

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing (as of public disclosure in September 2025; class-action investigation by Shamis & Gentile P.A.).

Most Recent Customer Advisory: The most recent customer advisory issued were an Affected individuals were notified with recommended actions (e.g., credit monitoring, fraud alerts, and reporting suspicious activity). and Data breach notification letters mailed to impacted individuals.

Most Recent Entry Point: The most recent entry point used by an initial access broker was an Employee email accounts.