Minnesota Epilepsy Group data breach: network access for almost four weeks in 2026

What happened at Minnesota Epilepsy Group?

The practice says it began an internal investigation, worked to secure its systems, notified law enforcement and hired a forensic security firm. The access window it gives ends on April 10, three days after the discovery.

Date	What the letter and the regulators' records say
March 16, 2026	First access in the window the forensic firm found
April 7, 2026	Practice discovers possible unauthorized access
April 10, 2026	Last access in the window
May 18, 2026	Practice finds personal information in the files
June 5, 2026	Report to HHS (80,061); logged in Massachusetts (28 residents)
October 14, 2026	A second Massachusetts record under the same name (28 residents)

The report to HHS came 18 days after the files were found to hold personal information, and about two months after the discovery.

Has Minnesota Epilepsy Group reported a breach before?

Yes. The HHS list also carries an April 28, 2025 hacking report under the name Minnesota Epilepsy Group, for 38,401 people. The 2026 letter does not mention it. The practice's own notice of that earlier incident, dated April 25, 2025, says it became aware on February 27, 2025 of a cybersecurity incident that affected systems in its network and disrupted some of its operations. At that point it listed information on the affected systems that is more clinical than the 2026 list: medical record numbers, EEG summaries, neuropsychology reports, medication records and health insurance information, besides names, addresses and dates of birth. It said it had no evidence that its cloud-based electronic health record was compromised.

	February 2025 incident	March to April 2026 incident
Found	February 27, 2025	April 7, 2026
Reported to HHS	April 28, 2025 (38,401)	June 5, 2026 (80,061)
Data named by the practice	Names, addresses, dates of birth, medical record numbers, EEG summaries, neuropsychology reports, medication records, health insurance	Name, address, date of birth, Social Security number, medical treatment information, health insurance information
Operations disrupted	Yes, some operations	Not stated

Massachusetts also lists two 2026 records for the practice, in June and October, each for 28 residents; the state's report does not say why.

What information was involved?

The mailed letter filed in Massachusetts lists name, address, date of birth and Social Security number. The practice's website notice for the 2026 incident is broader: depending on the person, it adds medical treatment information and health insurance information. Massachusetts' records also mark medical records as breached. The practice says it has no evidence of misuse for fraud or identity theft.

What is Minnesota Epilepsy Group offering?

Item	Detail from the letter
Service	Experian IdentityWorks Credit 3B, 24 months, with the enrollment deadline printed on each letter
Questions	866-659-7085, 8:00 a.m. to 8:00 p.m. Central Time, Monday to Friday

The website notice says the free identity protection is for the people whose Social Security numbers were involved, so not everyone among the 80,061 will have been offered it. Letters went only to people for whom the practice had a valid mailing address. The guide to credit monitoring offers sets Minnesota Epilepsy Group's offer beside other letters.

What the documents leave open

• How the intruder got in, and what happened between the April 7 discovery and the end of the window on April 10.
• Whether the 2025 and 2026 intrusions are connected; neither notice says.
• How many of the 80,061 had a Social Security number involved and were offered monitoring.
• Why Massachusetts holds two records for the practice.

With 80,061 people, Minnesota Epilepsy Group's report is the 57th largest of the 415 open 2026 reports in the ranking of 2026 healthcare breaches reported to HHS.