Iroquois Memorial Hospital data breach: five weeks inside the network, letters eleven months later

Date	Event
October 8, 2025	Earliest unauthorized access in the investigation's window
November 10, 2025	The hospital discovers suspicious activity; law enforcement is told
November 15, 2025	Last date of access in the investigation's window
January 9, 2026	Notice to the U.S. Department of Health and Human Services Office for Civil Rights
August 28, 2026	eDiscovery review results: personal information in the files
October 14, 2026	Letters; notices to New Hampshire (11) and Massachusetts (281)

What happened at Iroquois Memorial Hospital?

The intruder was inside for about five weeks before the hospital found it. The notice says IMH discovered suspicious activity in its computer network on November 10, 2025, began an internal investigation, secured its systems and contacted law enforcement. A forensic firm then traced access back to October 8. The window in the notice runs to November 15, five days after the discovery. The notice does not explain whether the access continued after the hospital found it. It also does not name the attacker, say how they got in, or say whether systems were encrypted.

Why did the letters take eleven months?

The file review. The notice says the hospital hired an eDiscovery vendor to review the involved files and received the results on August 28, 2026. It then checked the results and looked up current addresses, and mailed letters 47 days later. From the November 10, 2025 discovery to the October 14, 2026 letters is 338 days.

The hospital did notify the federal regulator well before that. It told the HHS Office for Civil Rights on January 9, 2026, about two months after the discovery. For how this compares with other notices, see the notice letter delay guide. The 2026 HHS breach list ranks the largest reports.

What information was exposed?

It varied by person. The notice lists names, dates of birth, Social Security numbers, medical treatment or diagnosis information and health insurance information. The Massachusetts record marks Social Security numbers, medical records and driver's licenses.

Record	People	Data it marks
Massachusetts OCABR, report 2026-1785 (October 14, 2026)	281	SSNs, medical records, driver's licenses
New Hampshire DOJ notice (October 14, 2026)	11	Name, date of birth, SSN, treatment or diagnosis, health insurance

What is the hospital offering?

A one-year membership to Epiq Privacy Solutions ID 3B credit monitoring, for people whose Social Security numbers may have been involved. The hospital says it has strengthened its technical safeguards. The healthcare provider breach notice guide shows how other providers handle this. The credit monitoring guide compares the offers.

What the documents leave open

• How many people were notified in total, and the count reported to HHS.
• How the intruder got in, and whether data was published.
• Whether those notified are patients, employees or both.