Lake Region Healthcare data breach: a May 2025 intrusion, and letters 13 months later

What happened at Lake Region Healthcare?

Lake Region says it secured its network, notified law enforcement and opened an investigation with outside cybersecurity professionals. It says it has no reason to believe its electronic health records system was affected. Its investigation found that the unauthorized individual or individuals may have accessed or removed certain files on or about May 19, 2025.

Date	What the letter and the regulators' records say
On or about May 19, 2025	Unauthorized access detected; files may have been accessed or removed
June 5, 2026	Lake Region determines whose information the files held
July 1, 2026	Letter date; report to HHS (167,617); Indiana notice (52 residents); logged in Massachusetts (20 residents)

Why did the letters take more than a year?

The letter says Lake Region reviewed the impacted system in full to find everyone whose information it held. It gives no other reason for the 13 months between detection and notice, or for the year between the access and the report to HHS. The guide to how long companies take to notify sets this gap against other notices.

What information was involved?

Each letter names the reader's own items; the sample leaves the list blank. For the 20 Massachusetts residents in Lake Region Healthcare Corporation's notice, the state's record marks Social Security numbers and medical records as breached. Lake Region says it has no evidence that anyone's information has been used for financial fraud or identity theft.

What is Lake Region Healthcare offering?

Item	Detail from the letter
Service	Single-bureau credit monitoring, credit report and credit score, with alerts for 12 months from enrollment, plus proactive fraud assistance
Provider	Cyberscout, a TransUnion company
Enrollment	Within 90 days of the letter date, at bfs.cyberscout.com/activate, with the code printed on the letter
Questions	1-844-507-9987, 7:00 a.m. to 7:00 p.m. Central Time, Monday to Friday, excluding holidays

The letter also recommends checking the explanation of benefits statements that health insurers send.

What Texas's attorney general recorded

Texas's attorney general lists a report from Lake Region Healthcare Corporation, posted on July 3, 2026, with 294 Texans affected, a count of Texas residents only. The record lists names, addresses, Social Security numbers, medical information, health insurance information and dates of birth as involved.

What the documents leave open

• How the intruder got in.
• What took from May 2025 to June 2026.

With 167,617 people, Lake Region Healthcare Corporation's report is the 33rd largest of the 415 open 2026 reports in the ranking of 2026 healthcare breaches reported to HHS.