Minnesota Epilepsy Group Falls Victim to Second 2026 Cyberattack
Minnesota Epilepsy Group, P.A., a Level 4 Epilepsy Center in Roseville, Minnesota, has announced that it has fallen victim to its second cyberattack of the year. The first incident involved unauthorized access to its network between March 16, 2026, and April 10, 2026, and affected 80,061 individuals. The latest incident occurred four months after the previous unauthorized access was terminated and affected a similar number of individuals: 82,574. It is unclear if the two incidents are related.
The latest incident was detected on August 10, 2026. Steps were taken to secure its network, and an internal investigation was launched to determine the nature and scope of the unauthorized activity. The investigation confirmed that an unauthorized third party had access to parts of its network on August 10, 2026. The files on the compromised parts of its network were reviewed, and on September 17, 2026, Minnesota Epilepsy Group confirmed that personal and protected health information had been compromised. The types of data involved varied from individual to individual and included names in combination with one or more of the following: address, dates of birth, Social Security number, medical treatment information, and health insurance information.
Notification letters started to be mailed to the affected individuals on October 16, 2026. At the time of issuing notification letters, no misuse of patient data had been identified. As a precaution against identity theft and fraud, individuals whose Social Security numbers were involved have been offered complimentary credit monitoring and identity theft protection services. Minnesota Epilepsy Group said it had previously taken steps to improve security and will be implementing additional cybersecurity measures to prevent similar incidents in the future.
Avail of a Free 30-Minute
Cybersecurity Consultation
with Blue Team Alpha
Review your security program, get advice on a specific cybersecurity concern, identify risk-reduction priorities, or take the first step toward your annual HIPAA Security Risk Assessment.
Learn More About This Offer
Hospice of Murray County
Hospice of Murray County in Slayton, Minnesota, has identified unauthorized access to one of its computer servers. The incident occurred on August 24, 2026, and the investigation confirmed that the server contained the protected health information of approximately 800 individuals, including names and other identifying information, Social Security numbers, medical information, other protected health information, and Social Security numbers. In an October 13, 2026, website notice, Hospice of Murray County said the investigation is ongoing; however, no evidence has been found to indicate that patient information was accessed or acquired.
