Vibra Hospital of Southeastern Massachusetts, a long-term acute care facility, suffered a data breach after a threat actor gained unauthorized access to six employee email accounts between March 11–22, 2025. The breach was detected on March 13, 2025, but the full impact was confirmed only on August 4, 2025, revealing that sensitive patient data—including names and Social Security numbers—was compromised. The incident affected at least two hospitals under Vibra Healthcare, with potential exposure of current and former patients across multiple locations. The breach was formally disclosed to authorities in October–November 2025, and impacted individuals were notified via mail. In response, Vibra secured its email systems, engaged cybersecurity experts, and offered 12 months of free credit monitoring to victims. The exact number of affected individuals remains undisclosed, but the exposure of personally identifiable information (PII) poses significant risks of identity theft, fraud, and phishing attacks.