Sturdy Health Inc. Reports Data Breach Affecting Over 1,000 Patients Sturdy Health Inc., a Massachusetts-based nonprofit health system, disclosed a data breach impacting 1,006 individuals across the U.S. The incident was reported to the U.S. Department of Health and Human Services on June 5, 2026. Headquartered in Attleboro, Sturdy Health operates a full-service network, including Sturdy Memorial Hospital and outpatient care centers, providing specialized services such as cardiac care, oncology, maternity, primary care, and chronic disease management. While the exact types of compromised data remain undisclosed, the breach involved protected health information (PHI), potentially including medical records, insurance details, or prescription data. Current and former patients of Sturdy Memorial Hospital and its affiliated locations may receive direct notifications from the organization. Those who suspect they were affected but have not been contacted can reach out to Sturdy Health for further details and available support.

On May 28, 2021, the Maine Office of the Attorney General disclosed a data breach at Sturdy Memorial Hospital, stemming from unauthorized access to its systems on February 9, 2021. The incident compromised the personal information of 42,336 individuals, including 28 Maine residents, exposing sensitive data that could lead to identity theft risks. While the exact type of data leaked was not fully detailed, the scale and nature of the breach—affecting a healthcare provider—suggest exposure of protected health information (PHI) or personally identifiable information (PII), such as names, addresses, Social Security numbers, or medical records.In response, the hospital offered two years of identity theft protection services via Experian to impacted individuals, indicating a proactive but reactive measure to mitigate potential harm. The breach underscores vulnerabilities in healthcare cybersecurity, where unauthorized system access can have severe repercussions for patient privacy and trust. Given the sector’s regulatory obligations (e.g., HIPAA), the incident likely triggered compliance investigations and potential penalties, beyond the immediate reputational and operational fallout.