In December 2024, Sturgis Hospital in Michigan detected a data breach within its network, followed by a second unauthorized activity wave in June 2025. Investigations revealed that an unauthorized third party accessed or acquired sensitive files between December 11–17, 2025, exposing 77,771+ individuals' data. Compromised information included personally identifiable information (PII)—such as names, contact details, Social Security numbers, and financial account data—as well as protected health information (PHI), including health insurance details, prescriptions, and clinical records. The breach prompted external cybersecurity interventions, law enforcement notifications, and public disclosure on September 18, 2025. Affected individuals were offered free identity theft protection (Experian IdentityWorks) and guidance on fraud monitoring. The incident posed severe risks of identity theft, financial fraud, and misuse of medical data, with potential long-term reputational and operational damage to the hospital. The breach’s scale and sensitivity of exposed data—spanning financial, governmental, and health records—highlighted critical vulnerabilities in the hospital’s cybersecurity infrastructure.