Multiple Healthcare Data Breaches Reported, Exposing Patient Social Security Numbers and Medical Data
Healthcare Data Breaches at MN Epilepsy Group, Campbell University, and City of Middletown Expose Patient Info
Impact Scope
People Affected
21,108+
Industries Affected
Geographic Impact
Related Entities
Threat Actors
Organizations
Other
Full Report
Executive Summary
A series of unrelated data breaches in the U.S. healthcare and public sectors have resulted in the exposure of sensitive personal and medical information for tens of thousands of individuals. Minnesota Epilepsy Group, the City of Middletown, and Campbell University have all recently announced cybersecurity incidents. The breaches involved unauthorized access to networks and cloud storage platforms, leading to the compromise of data including names, addresses, Social Security numbers, driver's license numbers, and detailed medical and health insurance information. One of the incidents, affecting the City of Middletown, has been linked to a 2025 ransomware attack by the SafePay ransomware group, underscoring the long tail of incident discovery and reporting.
Threat Overview
These incidents highlight the continued focus of cybercriminals on the healthcare sector, which holds highly valuable and sensitive data. The attack vectors vary but the outcome is the same: the compromise of Protected Health Information (PHI) and Personally Identifiable Information (PII).
Minnesota Epilepsy Group:
- Incident: Unauthorized third-party access to the network.
- Timeline: Access occurred between March 16 and April 10, 2026.
- Data Impacted: Names, addresses, dates of birth, Social Security numbers, medical treatment details, health insurance information.
City of Middletown:
- Incident: Ransomware attack attributed to the SafePay group (
T1486 - Data Encrypted for Impact). - Timeline: Attack occurred between July 29 and August 17, 2025, but was just announced.
- Data Impacted: Names, Social Security numbers, driver's licenses, financial accounts, medical and health insurance information.
- Scale: 20,608 individuals affected.
- Incident: Ransomware attack attributed to the SafePay group (
Campbell University:
- Incident: Unauthorized access to a single cloud-based data storage platform (
T1537 - Transfer Data to Cloud Account). - Timeline: Access occurred between March 31 and April 1, 2026.
- Scale: At least 500 individuals affected.
- Incident: Unauthorized access to a single cloud-based data storage platform (
Technical Analysis
The incidents demonstrate several common attack patterns targeting healthcare data:
- Network Intrusion: The Minnesota Epilepsy Group breach points to a classic network intrusion where an attacker gained access to internal systems and remained undetected for several weeks, allowing them time to discover and exfiltrate sensitive data (
T1083 - File and Directory Discovery). - Ransomware: The City of Middletown incident is a clear-cut ransomware attack. The SafePay group likely gained initial access, moved laterally, exfiltrated data for double extortion (
T1567 - Exfiltration Over Web Service), and then encrypted systems. The long delay between the attack (mid-2025) and notification (mid-2026) is concerning and often points to lengthy and complex forensic investigations. - Cloud Misconfiguration/Compromise: The Campbell University breach highlights the risks of cloud storage. The unauthorized access could stem from misconfigured permissions, compromised credentials, or a vulnerability in the cloud platform itself.
Impact Assessment
The impact on the affected individuals is severe and long-lasting.
- Identity Theft and Fraud: The exposure of Social Security numbers, names, and dates of birth creates a significant risk of identity theft, financial fraud, and fraudulent medical claims.
- Loss of Privacy: The breach of sensitive medical information is a profound violation of privacy that can cause significant personal distress.
- Regulatory Penalties: Under HIPAA, these organizations face potential investigation by the Department of Health and Human Services' Office for Civil Rights, which can result in substantial fines.
- Operational Costs: The organizations face significant costs related to forensic investigation, legal fees, providing credit monitoring services, and improving security controls.
IOCs — Directly from Articles
No specific technical indicators of compromise were provided in the summarized articles.
Cyber Observables — Hunting Hints
To hunt for similar threats, healthcare organizations should monitor for:
VPN/Remote Access LogsCloud Audit Logs (e.g., AWS CloudTrail)Large data transfers to unknown destinationsRansomware-related processesvssadmin.exe, wevtutil.exe, or processes performing rapid file encryption.Detection & Response
- Data Access Monitoring: Implement robust monitoring on all systems and repositories containing PHI/PII. Use Resource Access Pattern Analysis (D3-RAPA) to baseline normal access and alert on any deviations, such as a service account suddenly accessing thousands of patient records.
- Cloud Security Posture Management (CSPM): For cloud environments, use a CSPM tool to continuously scan for misconfigurations, public-facing data stores, and overly permissive IAM roles.
- EDR and Network Monitoring: Deploy EDR to detect ransomware behaviors and network monitoring to spot data exfiltration attempts. This provides defense-in-depth against both data theft and encryption.
Mitigation
- Data Encryption: All sensitive data, both at rest and in transit, must be encrypted. This is a fundamental requirement of HIPAA and is covered by M1041 - Encrypt Sensitive Information.
- Access Control: Enforce the principle of least privilege. Users and systems should only have access to the specific data they need to perform their function. This is a core part of M1018 - User Account Management.
- Multi-Factor Authentication (MFA): Mandate MFA for all remote access, cloud administration, and access to sensitive systems. This is a critical control under M1032 - Multi-factor Authentication.
- Vulnerability Management: Maintain a rigorous vulnerability management program to patch systems and applications in a timely manner, reducing the available attack surface (
M1051 - Update Software).
Timeline of Events
MITRE ATT&CK Mitigations
Encrypt Sensitive Information
Encrypt all PHI and PII at rest and in transit to protect it even if it is exfiltrated.
Mapped D3FEND Techniques:
Multi-factor Authentication
Enforce MFA for all access to systems containing sensitive patient data, including remote access and cloud platforms.
Mapped D3FEND Techniques:
Privileged Account Management
Implement the principle of least privilege to ensure users and applications can only access the minimum data necessary.
D3FEND Defensive Countermeasures
For healthcare organizations, protecting patient data repositories is paramount. Implement a User and Entity Behavior Analytics (UEBA) solution to perform Resource Access Pattern Analysis on Electronic Health Record (EHR) databases and file shares containing PHI. The system should baseline normal access patterns for each user and service account (e.g., a doctor typically accesses 20-30 patient records a day; a billing service account accesses specific fields in bulk at 2 AM). An alert should be triggered on any significant deviation, such as a doctor's account suddenly accessing 5,000 records or an account accessing data outside of normal working hours. This can detect a compromised account being used for data exfiltration before the data leaves the network.
Multi-factor Authentication is a non-negotiable control for the healthcare sector. It must be enforced on every possible access path to sensitive data. This includes all remote access (VPNs, VDI), all administrative access to servers and network devices, and, critically, all access to cloud services and platforms (like the one breached at Campbell University). Requiring a second factor of authentication (e.g., a push notification, OTP code) drastically reduces the risk of an attacker gaining access using only stolen credentials, which is a common initial access vector for ransomware and data theft attacks.
To limit the blast radius of an attack like the one at Minnesota Epilepsy Group, network segmentation is key. The network segment containing the EHR database and other critical patient data systems should be heavily isolated. Only specific, authorized application servers should be allowed to communicate with the database on the required ports. User workstations, IoT medical devices, and other less secure parts of the network should have no direct path to this critical data zone. This ensures that even if a user's workstation is compromised, the attacker cannot immediately pivot to the most sensitive data, buying valuable time for the security team to detect and respond.
Timeline of Events
Ransomware attack on the City of Middletown begins.
SafePay group lists the City of Middletown on its data leak site.
Unauthorized access to Minnesota Epilepsy Group's network begins.
Unauthorized access to Campbell University's cloud storage begins.
City of Middletown begins sending notification letters.
Minnesota Epilepsy Group begins sending notification letters.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.