Cedar Valley Services data breach: a December 2025 ransomware attack, 79,152 people notified in May 2026

Was Cedar Valley Services hit by ransomware?

Yes. The organization's own notice opens with it: on or about December 14, 2025, Cedar Valley Services experienced a ransomware incident that may have affected some people's information. It says it reported the incident to law enforcement and hired a national cybersecurity firm, and forensic specialists found the incident ran from December 12 to December 14.

The HIPAA Journal reported that the Qilin ransomware group added Cedar Valley Services to its leak site on December 21, 2025, with screenshots of data it said it had stolen, and that as of March 17, 2026 the full dataset did not appear to have been leaked. Cedar Valley's notice does not name a group.

What happened, and when?

Date	What happened	Source
December 12 to 14, 2025	Intruders in the systems, per the forensic investigation	Cedar Valley notice
On or about December 14, 2025	Ransomware incident	Cedar Valley notice
December 21, 2025	Qilin lists Cedar Valley Services on its leak site	HIPAA Journal
By March 18, 2026	Federal health breach report filed with a 501 placeholder count	HIPAA Journal
May 15, 2026	Letters mailed to potentially affected people	Cedar Valley notice; Indiana report

The notice explains the five months between the attack and the letters: after it identified the affected data, Cedar Valley ran "data mining" for several months to find out who was in it and which details, then worked to find enough address information to mail the letters. The 501 figure in the federal filing is a common placeholder when an organization does not yet know its count, The HIPAA Journal noted. The final total in Indiana's record is 79,152.

What information was exposed in the Cedar Valley Services breach?

It varies by person. The notice lists names, addresses, dates of birth and driver's license or government ID numbers, and says that for a limited number of people the data may also have included health-related information or Social Security numbers. Each letter lists the recipient's own details. The organization says it has had no reports of misuse, identity theft or fraud tied to the incident.

Who is Cedar Valley Services?

The HIPAA Journal describes it as a provider of vocational rehabilitation services to people in southern Minnesota, and says Cedar Valley reported the breach to the HHS Office for Civil Rights. Indiana's report shows how far beyond Minnesota the files reached: 1,154 of the people notified live in Indiana. The healthcare provider breach notice guide covers what other providers have told patients, and the largest health data breaches reported to HHS in 2026 lists the biggest.

Who do I call about a Cedar Valley Services letter?

The call center is (888) 651-0265, Monday to Friday except holidays, 9:00 a.m. to 7:00 p.m. Eastern time. The notice does not mention a credit monitoring offer; it points to free credit reports, fraud alerts and credit freezes, all of which anyone can set up at no cost.

What the record leaves open

• How the attackers got in.
• Whether a ransom was paid, and whether Qilin later published the data.
• How many of the 79,152 had health information or Social Security numbers in the files.