Penobscot Valley Hospital data breach: patient and employee files in a January intrusion

Date	Event
January 28, 2026	The hospital is alerted to suspicious activity in its IT environment; law enforcement is told
February 12, 2026	The investigation finds an unauthorized person may have accessed certain files and folders
June 4, 2026	The investigation finds personal and health information in the affected files
July 21, 2026	The hospital starts notifying patients and employees (Bangor Daily News)
July 27, 2026	Report to Massachusetts (498 residents)

What happened at Penobscot Valley Hospital?

The hospital's notice describes an intrusion found by an alert. It says that once it was alerted on January 28, the hospital put its incident response procedures into effect, secured its systems, hired third-party forensic specialists and notified law enforcement. The notice says an unauthorized individual may have accessed files and folders. It does not say whether data was copied out, whether systems were encrypted, or how the intruder got in.

The investigation ran in three steps: the alert on January 28, a finding about file access on February 12, and a finding on June 4 that the files held personal information and protected health information. The notifications started 47 days after that last finding.

Who was affected?

Patients and employees. The notice says the hospital began notifying certain patients and employees whose information was involved. Neither the notice nor the news report gives a total. The Massachusetts count of 498 is the only number in the records this site checked. Maine's own breach notice viewer did not load for this desk, so the Maine count is not known here.

What information was exposed?

It varied by person. The notice lists names with one or more of address, date of birth, Social Security number, medical information related to a visit to the hospital, and financial information.

Record	People	Data it marks
Massachusetts OCABR, report 2026-1229 (July 27, 2026)	498	SSNs, medical records, financial accounts
Hospital notice (July 21, 2026)	Not given	Name, address, date of birth, SSN, visit medical information, financial information

The Massachusetts report lists the hospital's organization type as "State Government". That is how the report is filed, not a statement about who owns the hospital.

What is the hospital offering?

Complimentary identity monitoring for the people whose information may have been involved. The notice also asks people to check the statements they get from healthcare providers and health plans, and to contact the provider or plan right away about any service they did not receive. The hospital set up a call center at 1-833-319-8871, open 8 a.m. to 8 p.m. Eastern on weekdays. The notice says it has added safeguards and technical security measures to protect and monitor its systems.

For how other hospitals and clinics word these letters, see the healthcare provider breach notice guide. The credit monitoring guide compares the offers.

Why can't I find the notice on the hospital's website?

The page the hospital posted, pvhme.org/post-incident-media-notice, now returns a "page not found" message. This entry cites a copy the Internet Archive saved on August 12, 2026. The call center number above is the one in that notice.

What the documents leave open

• The total number of patients and employees notified.
• Whether data was copied out of the network, and whether a ransom was demanded.
• The count reported to the U.S. Department of Health and Human Services, which this desk could not retrieve.