Nacogdoches Memorial Hospital data breach: what the letter says and why the counts differ

What happened at Nacogdoches Memorial Hospital?

The hospital says it notified law enforcement right away, started its incident response plan and opened an investigation. After it secured its network again, it says it hardened its network security and completed an investigation into the extent of the activity.

The letter does not say how the attacker got in, how long the access lasted, or whether files were copied. It says only that the investigation found the party "may have had access" to health information.

Date	What the letter and the regulators' records say
January 31, 2026	The hospital becomes aware of the cyber-attack; Indiana gives this as the breach date
March 12, 2026	Indiana's report gives this as the date notice was sent
March 30, 2026	Report submitted to HHS: hacking or IT incident, network server

Notice went out 40 days after the hospital learned of the attack. The federal rule allows no more than 60 calendar days from discovery. The guide to how long notices take compares that gap across the log.

What information was involved?

The letter lists name, address, phone number, email address, Social Security number, date of birth, medical record number, account number and health plan beneficiary number, and possibly a full-face photograph if one was taken. It says the hospital has no evidence that any of the information has been misused.

Kind of information	Named in the letter
Contact details	Name, address, phone number, email address
Identity	Social Security number, date of birth, possible full-face photograph
Hospital records	Medical record number, account number
Insurance	Health plan beneficiary number

How many people were affected by the Nacogdoches Memorial Hospital breach?

Regulator	What it counts	Number
HHS Office for Civil Rights	Individuals affected	2,507,073
Indiana attorney general	Total affected	257,073
Indiana attorney general	Indiana residents	57

The two totals share every digit except one: Indiana's has no zero after the "25". Neither regulator explains the difference, and the letter gives no count. The HHS ranking sets this gap beside the other large reports whose HHS and Indiana totals disagree.

Is Nacogdoches Memorial Hospital offering credit monitoring?

The letter's text does not offer credit monitoring or identity protection. It asks people to watch their accounts, report suspicious activity, and read an attached sheet on fraud alerts and security freezes. The guide to monitoring offers in breach letters shows what other senders include.

Item	Detail from the letter
Phone	888.460.3229
Email	nchdhipaa@nachd.org
Postal address	1204 N. Mound Street, Nacogdoches, TX 75961

What is the hospital changing?

It says it has put remediation measures in place to prevent a recurrence and strengthen its network security. It is also adding awareness training and updating its procedures.

What the documents leave open

• How the attacker got into the network, and when the access began and ended.
• Whether data was copied out, or only reachable.
• Which of the two regulator totals, 2,507,073 or 257,073, is right.
• How many Texans were affected. The Texas attorney general's list, read on November 7, 2026, has no report under the hospital's name.

For how hospital and clinic letters compare, see the guide to healthcare provider breach notices and the HIPAA breach notification rule.