Penobscot Valley Hospital Discloses 7-Month-Old Data Breach Impacting Patient and Employee Records
Penobscot Valley Hospital in Lincoln, Maine, began notifying patients and employees this week that their personal and medical information may have been compromised in a cybersecurity breach that occurred nearly seven months ago.
The incident was first detected on January 28, when the hospital identified suspicious activity in its IT systems. Following its response protocol, the hospital secured its systems, engaged forensic specialists, and notified law enforcement. By February 12, investigators confirmed that an unauthorized individual had accessed files and folders.
A subsequent review on June 4 revealed that sensitive data including names, addresses, dates of birth, Social Security numbers, financial details, and protected health information may have been exposed. Despite confirming the breach in February, the hospital delayed notifying affected individuals until this week.
In response, the hospital is offering identity monitoring services to those impacted and advising patients to review insurance and medical statements for fraudulent activity. Additional technical safeguards have since been implemented to prevent future breaches.
Penobscot Valley Hospital cybersecurity rating report: https://www.rankiteo.com/company/penobscot-valley-hospital
"id": "PEN1784666444",
"linkid": "penobscot-valley-hospital",
"type": "Breach",
"date": "1/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Patients and employees',
'industry': 'Healthcare',
'location': 'Lincoln, Maine, USA',
'name': 'Penobscot Valley Hospital',
'type': 'Healthcare Provider'}],
'customer_advisories': 'Advised patients to review insurance and medical '
'statements for fraudulent activity',
'data_breach': {'personally_identifiable_information': 'Names, addresses, '
'dates of birth, '
'Social Security '
'numbers',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Personal Information',
'Medical Information',
'Financial Details']},
'date_detected': '2024-01-28',
'date_publicly_disclosed': '2024-08-07',
'description': 'Penobscot Valley Hospital in Lincoln, Maine, disclosed a data '
'breach impacting patient and employee records after detecting '
'suspicious activity in its IT systems. The breach exposed '
'sensitive personal and medical information, including names, '
'addresses, Social Security numbers, and protected health '
'information.',
'impact': {'data_compromised': 'Personal and medical information, including '
'names, addresses, dates of birth, Social '
'Security numbers, financial details, and '
'protected health information',
'identity_theft_risk': 'High',
'payment_information_risk': 'High',
'systems_affected': 'IT systems'},
'investigation_status': 'Completed',
'post_incident_analysis': {'corrective_actions': 'Additional technical '
'safeguards implemented'},
'recommendations': 'Review insurance and medical statements for fraudulent '
'activity; implement additional technical safeguards',
'references': [{'source': 'Cyber Incident Description'}],
'regulatory_compliance': {'regulations_violated': ['HIPAA']},
'response': {'communication_strategy': 'Notified affected individuals and '
'offered identity monitoring services',
'containment_measures': 'Secured IT systems',
'incident_response_plan_activated': 'Yes',
'law_enforcement_notified': 'Yes',
'remediation_measures': 'Additional technical safeguards '
'implemented',
'third_party_assistance': 'Forensic specialists'},
'title': 'Penobscot Valley Hospital Data Breach',
'type': 'Data Breach'}