City of Middletown, Ohio data breach: 123,791 people, a network accessed from July 29 to August 17, 2025

Was the City of Middletown hit by ransomware?

The city has not used the word. Its own updates call it a cybersecurity incident, and its letter calls it a security incident affecting its network. HIPAA Journal reports that the SafePay ransomware group added the city to its dark web leak site on September 12, 2025 and later leaked the stolen data. No city document seen for this entry names a group, says how the intruder got in, or mentions a ransom demand.

What the city did describe is an outage. In its October 2025 update it said it had shut down affected services in mid-August and brought in outside specialists to restore them and investigate.

What happened to city services?

Phones, Wi-Fi and city email were down for about ten weeks. The city said on October 27, 2025 that it had begun a phased restoration and that those three were back. At that point utility billing still could not produce new bills, and the police department could not run fingerprint-based criminal background checks; the city pointed residents to county sheriff's offices and other agencies for those.

Water bills were the longest-running effect. In a November 20, 2025 update the city said bills would resume in December, estimated from the same period a year earlier plus 25% to cover part of the months with no billing. Flat fees for refuse, stormwater and toters were to be back-billed in full. The city had paused all shutoffs during the outage and said it was resuming them for accounts that were already past due before the incident. Payments for bills issued before the outage still went through InvoiceCloud, the outside service the city uses, which the city said was not affected.

What happened, and when?

Date	What happened	Source
July 29, 2025	Start of the window in which files on the affected servers may have been accessed or acquired; Indiana's breach date	Letter to New Hampshire; Indiana record
On or about August 17, 2025	Unauthorized access to the network; end of the window	Letter to New Hampshire
September 12, 2025	SafePay lists the city on its leak site, per HIPAA Journal	HIPAA Journal
October 27, 2025	Phones, Wi-Fi and email restored; phased restoration begins	City update
November 20, 2025	City says utility bills resume in December	City update
May 18, 2026	File review finds personal information in the affected files	Letter to New Hampshire
June 3, 2026	Letters to residents begin; Indiana's notice date; report to HHS (20,608)	Letter to New Hampshire; Indiana record; HHS portal

From the end of the access window to the first letters took 290 days. The notice-delay guide shows that long reviews of this kind are common; among the local governments in Indiana's report, the median gap is about six months, and the City of Suffolk, Virginia notified in 56 days.

What information was involved in the Middletown breach?

The city's notice to New Hampshire lists three items: full name, Social Security number, and driver's license or state identification number. The notice also says the files held personal and/or protected health information, so some people's health records were in them too.

HIPAA Journal gives a longer list: names, addresses, Social Security numbers, driver's license or government ID, financial account information, medical information and health insurance information. It reports that the federal health privacy office was told the protected health information of 20,608 people was involved. The federal breach portal confirms it: the City of Middletown, Ohio, filed as a healthcare provider on June 3, 2026, reporting 20,608 individuals and a hacking/IT incident involving a network server. Each letter lists the reader's own items, so the letter is the place to check what was in your file.

How many people were affected by the City of Middletown breach?

123,791 people, the total Indiana's attorney general records; 140 of them live in Indiana. The New Hampshire letter covers about three New Hampshire residents. Of the 29 city, town and county governments in Indiana's 2026 report, only the City of Suffolk, Virginia (157,725) reported more, and Winona County, Minnesota (123,476) comes just after, as the guide to local government breach notices shows.

Record	What it counts	Number
Indiana attorney general	People affected in total	123,791
HHS Office for Civil Rights	People whose health information was involved	20,608
Indiana attorney general	Indiana residents	140
New Hampshire letter	New Hampshire residents (approximately)	3

Indiana's report lists the sender only as "City of Middletown". The dates in its row, a July 29, 2025 breach and a June 3, 2026 notice, match the Ohio city's letter.

What is Middletown offering people who got a letter?

Credit monitoring for people whose Social Security number was in the files. The letter describes single-bureau credit monitoring, a single-bureau credit report and score, and fraud assistance from Cyberscout, a TransUnion company, at no charge. The length of the service and the enrollment code are printed on each letter. The guide to credit monitoring offers in breach letters explains what a single-bureau service does and does not watch.

The city says it has seen no sign that the data was used for fraud.

Was my information in the City of Middletown data breach?

If you got a letter from the City of Middletown, 1 Donham Plaza, Middletown, OH, in June 2026, your information was in the files the city reviewed. HIPAA Journal reports that letters went to people with a complete address on file, so someone the city could not find an address for may not have received one. The letter gives a toll-free response line open Monday to Friday, 8:00 a.m. to 8:00 p.m. Eastern time; the city's general line is 513-425-7766.

Who did the city tell?

The city says it coordinated with federal, state and local law enforcement during the investigation. A law firm, McDonald Hopkins PLC, wrote to New Hampshire's attorney general on the city's behalf on June 3, 2026.

What the documents leave open

• How the intruder got into the network, and whether anything was encrypted.
• Which groups of people the 123,791 total covers: residents, employees, utility customers or patients.
• Whether the city paid or was asked for a ransom.
• How long the credit monitoring runs.