Saint Anthony Hospital data breach: two employee email accounts, and letters a year later

What happened at Saint Anthony Hospital?

The hospital says it secured its network, reported the incident to law enforcement and opened an investigation with outside cybersecurity professionals. Its review of the data in the two mailboxes ended on February 13, 2026.

Date	What the letter and the regulators' records say
On or around February 27, 2025	Hospital learns two employee email accounts may have been accessed
September 12, 2025	An earlier HHS report under the hospital's name: 6,679 people, email
February 13, 2026	Review finds personal information in the files
March 6, 2026	Letter date; report to HHS (146,108)
March 7, 2026	Logged in Massachusetts (4 residents)

The HHS list carries two email reports under the hospital's name, six months apart. The March 2026 letter does not mention the earlier one, and the list does not say whether they concern the same accounts. The letters went out a year after the hospital learned of the access.

Is the 2026 Saint Anthony letter about the same breach as the 2025 one?

The public record points that way, though no notice says so outright. In November 2025, CBS News Chicago reported that the hospital had learned in February that an unauthorized party might have accessed some employee email accounts. It said more than 6,600 patients and staff might have been exposed. The HIPAA Journal put the HHS count for that notice at 6,679 and the date access was identified at February 6, 2025. The 2025 hotline is the same number printed on the March 2026 letters, 877-580-4384. The hospital said then that it would notify anyone else it found was affected.

	First notice (2025)	Second notice (2026)
When access was found	February 6, 2025 (HIPAA Journal)	On or around February 27, 2025 (letter)
What was accessed	Some employee email accounts	Two employee email accounts
HHS count	6,679	146,108
Indiana record	6,679 in total, 3 Indiana residents; breach date November 8, 2024
Who	Patients and staff	Readers of the letter
Hotline	877-580-4384	877-580-4384

Indiana's 2025 report carries the first notice too, with the same 6,679 total, a notice date of September 12, 2025 and a breach date of November 8, 2024, three months before either discovery date. No document says what happened on that date. One open point is the discovery date: February 6 in the press report of the first notice, "on or around February 27" in the 2026 letter. The 2026 count is about 22 times the first.

What information was involved?

The letter lists the reader's name and date of birth; medical history, condition, treatment or diagnosis; prescription information; health insurance policy or subscriber number; patient address, dates of service, medical record number and account number; Social Security number; and health insurance application or claim information. For the 4 Massachusetts residents in Saint Anthony Hospital's notice, the state's record marks Social Security numbers and medical records as breached.

The guide to healthcare provider breach notices compares other providers' letters.

What is Saint Anthony Hospital offering?

Item	Detail from the letter
Service	Single-bureau credit monitoring, credit report and credit score, with alerts for 24 months from enrollment
Provider	Cyberscout
Enrollment	Within 90 days of the letter date, at bfs.cyberscout.com/activate, with the code printed on the letter
Questions	877-580-4384, 8:00 a.m. to 8:00 p.m. EST

The hospital says it has no evidence that anyone's information has been used for financial fraud or identity theft.

What the documents leave open

• How the unauthorized party got into the two accounts.
• Whether the hospital treats the 2025 and 2026 reports as one incident, and why the discovery dates differ.
• How long the accounts were open to the intruder.

With 146,108 people, Saint Anthony Hospital's report is the 37th largest of the 415 open 2026 reports in the ranking of 2026 healthcare breaches reported to HHS.