Graham County Hospital Notifies Indiana of 2025 Data Breach

Graham County Hospital in Indiana formally reported a data security incident to state regulators on September 14, 2026. The breach event itself occurred on December 18, 2025, with the specific type of security failure remaining unspecified in public filings. This disclosure indicates an unauthorized compromise within the hospital's internal network infrastructure.

The filing confirms that sensitive personal and health information was exposed during the incident. Categories of data impacted include Full Name, Date of Birth, Social Security Number, Medical Record Number, and Health Insurance ID Number. Additionally, detailed health information such as Diagnosis and Treatment Information, Prescription Information, and Provider and Treatment Dates were part of the exposure.

The investigation into the incident is currently in a monitoring status. The exposure of such comprehensive personal and health data carries significant, long-term risks for affected individuals. Unlike financial accounts which can often be closed or reissued, medical and identity information is permanent, potentially leading to medical identity theft or sophisticated financial fraud.

Individuals who receive a notification related to this incident should remain vigilant. It is recommended to regularly review Explanation of Benefits statements from health insurers for any unauthorized services and to carefully check credit reports from major bureaus for unusual or unfamiliar account activity. Placing a credit freeze or fraud alert with major credit reporting agencies can also help prevent new accounts from being opened fraudulently in your name.