Michigan Critical Access Hospital Suffers Two Hacking Incidents Affecting Almost 78,000 Individuals
Sturgis Hospital, a rural critical access hospital in Michigan, has recently reported two security incidents to the HHS’ Office for Civil Rights, both of which have potentially affected up to 77,771 individuals. The first incident was identified in December 2024 when unauthorized activity was observed in part of its computer network. Third-party cybersecurity experts were engaged to investigate the incident and determine the nature and scope of the unauthorized activity. Unauthorized access was confirmed, the incident was remediated, and the exposed files were reviewed to determine the individuals affected and the types of data involved.
The investigation and file review had not concluded when further unauthorized network activity was detected in June 2025. A separate investigation was launched into the second incident, with assistance provided by third-party experts. Based on the two investigations, Sturgis Hospital concluded that there was potentially unauthorized access to patient and employee information and files containing sensitive patient and employee data may have been exfiltrated from its network.
The file review confirmed that the exposed information included names, contact information, government identification numbers such as Social Security numbers, financial account information, health insurance information, and clinical information, such as treatment information, prescriptions, and other medical information. Sturgis Hospital said it worked with third-party cybersecurity experts to secure its systems and implement additional cybersecurity measures to prevent similar incidents in the future. The affected individuals have been offered complimentary subscriptions to credit monitoring and identity theft protection services. Law enforcement was notified about both incidents, and while law enforcement did not request delaying notifications, it has taken some time to investigate the incidents. Notification letters are now being mailed to the affected individuals.
Only a few weeks ago, Aspire Rural Health System, another rural healthcare provider in Michigan, announced a cyberattack and data breach that affected up to 140,000 individuals, and Endless Mountains Health Systems in Montrose, Pennsylvania, experienced a suspected ransomware attack in March 2025. Many rural healthcare providers are struggling to remain viable, and in some cases are providing care well below the cost of providing their healthcare services. With limited funds available for cybersecurity and difficulties attracting skilled cybersecurity staff, they can be vulnerable to cyberattacks. The HHS has recently confirmed that $50 billion is being made available in grants to transform rural healthcare over the next five years, one of the goals of which is to help rural healthcare providers invest in technology and improve cybersecurity.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
