Nacogdoches Memorial Hospital Data Breach More Than 257,000 Individuals
Nacogdoches Memorial Hospital (NMH), a 226-bed hospital in Nacogdoches, Texas, has recently announced a data security incident that was first identified on January 31, 2026. A hacker gained access to its computer network and information systems and potentially obtained files containing the personal and protected health information of up to 257,073 individuals, according to the notification sent to the Maine Attorney General.
While the data security incident was detected on January 31, 2026, the forensic investigation determined that the hacker first gained access to its network two weeks previously, on January 15, 2026. NMH explained in its notification letters that it has not detected any misuse of the impacted data and that there are no indications that there will be any data misuse.
While NMH said the hacker may have accessed or acquired patient information, with two weeks inside its network, patients should assume that their data has been compromised and should consider taking steps to prevent data misuse, such as implementing a fraud alert or security freeze with one of the three credit reporting bureaus, Equifax, TransUnion, or Experian. The notice to the Maine Attorney General states that complimentary credit monitoring and identity theft protection services are not being offered.
NMH’s investigation determined that the impacted data includes names, addresses, phone numbers, email addresses, Social Security numbers, dates of birth, medical record numbers, account numbers, health plan beneficiary numbers, and, for certain individuals, full face photograph images. In response to the cybersecurity incident, NMH has strengthened the security of its information systems and computer network to reduce the risk of similar incidents in the future and is enhancing its cyber preparedness through additional training and updates to its policies and procedures. Law enforcement has been informed, and NMH will assist with any law enforcement investigation. Notification letters were mailed to the affected individuals on March 31, 2026. As of April 1, 2026, no threat group appears to have claimed responsibility for the incident.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
