Cottage Hospital data breach: staff and patient files from October 2025, 37,796 people

Who received a letter from Cottage Hospital?

The letter filed with Massachusetts is addressed to staff. It says the incident involved some of the hospital's employee and physician information, and that the medical or health insurance information of readers who are or were patients may also be involved. The records count very different groups. HHS counts 37,796 people. Indiana's total is 2,156, and Massachusetts logged 62 residents.

Date	What the letter and the regulators' records say
October 14, 2025	Date of breach on Indiana's record
February 6, 2026	Letter date; report to HHS (37,796); Indiana notice (2,156 total; 8 in Indiana)
February 7, 2026	Logged in Massachusetts (62 residents)

The letter gives no incident dates and does not say how the files were reached. Indiana's record dates the breach to October 14, 2025, about 16 weeks before the letters. For the 62 Massachusetts residents in Cottage Hospital's notice, the state's record marks Social Security numbers, financial accounts and driver's licenses as breached, and not medical records.

What happened at Cottage Hospital, and when?

The hospital's website notice, posted after its investigation ended, fills in the dates the staff letter left out. Cottage Hospital first learned of the incident on December 8, 2025, and found that an unauthorized party had been in its computer network from October 14 to October 21, 2025. It says the incident was limited to files on one of its file servers and did not reach its electronic health record system. The Valley News, reporting from Woodsville, described the same week-long access to one server.

Date	What happened	Source
October 14 to 21, 2025	Unauthorized party in the hospital's network	Hospital notice; Indiana record
December 8, 2025	Hospital first learns of the incident	Hospital notice
February 5 to July 2, 2026	Letters mailed, staff first	Hospital notice; staff letter
May 28, 2026	Files with patient information identified	Hospital notice

Were Cottage Hospital patients notified?

Yes, later than staff. On May 28, 2026, the hospital identified files containing patient information, and its letters went out in stages between February 5 and July 2, 2026. The patient files held names with one or more of contact details, birth dates, health insurance information, provider names, internal patient ID numbers, dates of service, medication information and treatment or diagnosis information. In limited cases they also held Social Security or taxpayer ID numbers, payment card or financial account numbers, or driver's license, state ID or military ID numbers. That fits the gap between the more than 1,600 people in New Hampshire and Vermont that the Valley News counted from the February staff letters and the 37,796 in the hospital's report to HHS. The hospital advises patients to check statements from their providers and health plan for services they did not receive.

What has Cottage Hospital done?

The hospital says it will keep adding safeguards and security measures and keep training employees on security.

What is Cottage Hospital offering?

Item	Detail from the letter
Service	Experian IdentityWorks Credit, 24 months
Enrollment deadline	May 29, 2026 (passed)
Questions	833-918-4978, Monday to Friday, 9 a.m. to 9 p.m. Eastern Time, except major U.S. holidays

The enrollment deadline has passed. The guide to credit monitoring offers sets Cottage Hospital's offer beside other letters.

What the documents leave open

• How the unauthorized party got into the network.
• How many of the 37,796 are patients and how many are staff.
• Why seven weeks passed between the access and its discovery.

With 37,796 people, Cottage Hospital's report is the 86th largest of the 415 open 2026 reports in the ranking of 2026 healthcare breaches reported to HHS.