Data breaches have recently been reported by Cedar Valley Services and Health Dimensions Group in Minnesota, and Community Nurse in Massachusetts.

Cedar Valley Services, Minnesota

Cedar Valley Services, a provider of vocational rehabilitation services to individuals in Southern Minnesota, has notified the HHS’ Office for Civil Rights about a data incident that involved the exposure of individuals’ protected health information. Little information about the incident has been publicly disclosed by Cedar Valley Services at this point, other than it being a hacking/IT incident affecting at least 501 individuals. The 501 total provided to the HHS’ Office for Civil Rights is a commonly used placeholder figure when the number of affected individuals has yet to be determined.

This appears to have been a ransomware attack by the Qilin ransomware group, which added Cedar Valley Services to its dark web data leak site in December 2025. Qilin claims to have exfiltrated sensitive data in the attack. The listing was added on December 21, 2025, and screenshots of data allegedly stolen in the attack have been uploaded to the data leak site as proof; however, as of March 17, 2026, the full dataset does not appear to have been leaked.

Community Nurse, Massachusetts

Community Nurse, a Fairhaven, MA-based home health agency, has confirmed that the personal and protected health information of 6,746 individuals has potentially been compromised in a security incident at its document management and billing services vendor, Doctor Alliance. Doctor Alliance experienced a network disruption on November 13, 2025. The forensic investigation determined that a threat actor may have viewed or acquired files without authorization between October 31, 2025, and November 17, 2025.

The analysis of those files was completed on March 2, 2026, and confirmed that they contained information such as names, addresses, dates of birth, Medicare numbers, start of care dates, certification period dates, medical record numbers, provider names and addresses, type of advance directives, diagnoses/current health statuses, medication lists, treatment orders, and goals of treatment. Doctor Alliance has implemented additional security measures to prevent similar incidents in the future, and notification letters have now been mailed to the affected individuals.

Health Dimensions Group, Minnesota

Health Dimensions Group, a Minneapolis, Minnesota-based provider of senior living and senior care management and consulting services, has reported a data breach to the Maine Attorney General that affected 450 individuals, including 1 Maine resident. Legal counsel for Health Dimensions Group explained in the notification letters that it first learned about a cybersecurity incident on October 20, 2025, and activated its incident response plan. Third-party cybersecurity experts were engaged to investigate the incident and assist with securing its environment, and they confirmed on November 6, 2025, that files were obtained in the incident.

The data review was completed on February 4, 2026, when it was confirmed that information relating to independent contractors was compromised in the incident, including names, addresses, and Social Security numbers. Notification letters were mailed to the affected individuals on March 11, 2026. While no data misuse has been identified, complimentary credit monitoring and identity theft protection services have been made available. The Worldleaks threat group claimed responsibility for the attack and leaked the stolen data, indicating the ransom was not paid. Since data has been leaked online, the affected individuals are advised to take advantage of the free credit monitoring services being offered.

The post PHI Exposed in Data Breaches at Cedar Valley Services; Community Nurse; Health Dimensions Group appeared first on The HIPAA Journal.

The Chicago, IL-based Catholic health system CommonSpirit Health has announced that it has been affected by a security incident at a vendor of one of its business associates.  The healthcare consulting company Pinnacle Holdings Ltd experienced network disruption on November 25, 2024, as a result of a ransomware attack. The ransomware group had access to Pinnacle’s network from November 11, 2024, to November 25, 2024. During that time, files were exfiltrated from Pinnacle’s network.

Pinnacle was a vendor of CommonSpirit Health’s vendor, NorthGauge Healthcare Advisors. In a breach notice issued to the Washington Attorney General on behalf of CommonSpirit Health, NorthGauge explained that Pinnacle immediately isolated its network when the attack was detected and has since implemented additional security measures to prevent similar incidents in the future. NorthGauge explained that Pinnacle had strict policies and procedures in place concerning data retention and data destruction, which limited the amount of data compromised in the incident.

Pinnacle engaged a third-party vendor to review the exposed data, and in November 2025 – a year after the attack – Pinnacle notified NorthGauge about the incident. NorthGuage said it did not receive confirmation about the identities of the affected individuals until January 30, 2026, and notified CommonSpirit Health about the affected Washington residents on February 2, 2026. NorthGauge said individual notification letters will be mailed to the affected Washington residents as soon as up-to-date contact information has been obtained. Those individuals are being offered complimentary credit monitoring and identity theft protection services.

The breach notice does not state the types of data compromised in the incident; however, they are stated in the individual notification letters to the affected individuals. According to the Washington Attorney General, the breach affected 19,027 Washington residents. The incident is not currently listed on the HHS’ Office for Civil Rights website, so it is unclear if individuals in other states have also been affected.

The post CommonSpirit Health Patients Affected by Vendor Data Breach appeared first on The HIPAA Journal.

Meadowlark Hills retirement community in Kansas and MedPeds Associates of Sarasota in Florida have announced data breaches. The Beast ransomware group has claimed responsibility for both attacks.

Manhattan Retirement Foundation (Meadowlark Hills), Kansas

Manhattan Retirement Foundation, doing business as Meadowlark Hills, has reported a breach of the protected health information of 14,442 individuals to the HHS’ Office for Civil Rights. The Manhattan, KS-based non-profit retirement community and skilled nursing facility explained that unauthorized access to its network was identified on or around July 21, 2025. The forensic investigation determined that there had been unauthorized network access between July 12, 2025, and July 21, 2025. During that time, files containing personal and protected health information were exfiltrated from its network.

The review of the files on the compromised parts of its network was completed on January 28, 2026, when it was confirmed that the following data elements were involved: name, date of birth, Social Security number, Driver’s license number/state identification number, other government identifiers, financial account information, credit/debit card information, health insurance information, and medical information.

Written notification letters were mailed to affected individuals in late February, and complimentary single-bureau credit monitoring and identity theft protection services have been made available to individuals whose Social Security numbers were involved. The Beast threat group claimed responsibility for the attack and claims to have exfiltrated 750 GB of data.

MedPeds Associates of Sarasota

MedPeds Associates of Sarasota, an internal and pediatric medicine practice in Florida, is notifying 21,430 individuals about a data breach involving their personal and protected health information. According to the notification letters, MedPeds identified unauthorized access to its computer network on September 2, 2025, when ransomware was used to encrypt files.

MedPeds said some patient data was subject to unauthorized access during the attack. The affected files have been reviewed and found to contain names, birth dates, addresses, phone numbers, and patient medical records. The FBI was notified about the intrusion, and the practice has been working with the FBI’s cybersecurity department and has implemented additional safeguards and security measures to prevent similar incidents in the future.

No evidence has been found to indicate any misuse of the impacted data; however, as a precaution, the affected individuals have been offered complimentary credit monitoring and identity theft protection services. While the name of the group was not disclosed by MedPeds, the Beast ransomware group claimed responsibility for the attack. The group claimed to have exfiltrated 400 GB of data and added MedPeds to its data leak site; however, the data allegedly stolen in the attack does not appear to have been published at the time of writing.

The post Ransomware Group Claims Attacks on Meadowlark Hills Retirement Community & MedPeds appeared first on The HIPAA Journal.