Bigfork Valley Hospital Data Breach 2025: 8,496 Affected · Hacking/IT Incident · MN. Filed With HHS OCR. What To Do.

Bigfork Valley Hospital, a critical-access hospital serving Itasca County in rural northern Minnesota, filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights on March 25, 2025, reporting 8,496 affected individuals in a Hacking/IT Incident event at Email. The hospital’s investigation traced the unauthorized access to a single employee email account; notification letters went out the same day the OCR filing was made.

Timeline

• November 4, 2024 — An unauthorized third party accessed an employee email account at Bigfork Valley Hospital.
• November 26, 2024 — The hospital detected suspicious activity on the account, secured the mailbox, and engaged outside digital-forensics specialists to scope the intrusion.
• January 28, 2025 — Forensic review confirmed that emails and attachments inside the compromised mailbox contained patient personal and protected health information.
• March 25, 2025 — Bigfork Valley filed the breach with HHS OCR and began mailing individual notification letters to all 8,496 affected people.
• April 2025 — Plaintiffs’ firms Strauss Borrelli PLLC and Levi & Korsinsky LLP publicly announced investigations into potential class claims.

What was exposed

Per the hospital’s own notification and reporting by HIPAA Journal and Healthcare Facilities Today, the data elements inside the compromised mailbox varied by individual and could include: names, phone numbers, dates of birth, Social Security numbers, driver’s license or state ID numbers, financial account numbers, patient account numbers, Medicare/Medicaid numbers, and health insurance member numbers, along with clinical information such as diagnoses, treatment and procedure details, cost of treatment, medical history and allergies, prescription drug information, lab results and medical images, and admission and treatment dates, locations, and provider names.

The hospital states it has no evidence that any of the exposed information has been misused.

Why this matters for a rural critical-access hospital

Bigfork Valley is a Medicare-designated critical-access hospital (CAH) and the principal provider of inpatient, emergency, and long-term care services for a small population in northern Itasca County. CAHs typically serve a few thousand residents in their primary catchment area, so an 8,496-person notification covers a meaningful share of patients who have ever interacted with the facility. Multi-generational households and small-town overlap mean a single notification often reaches every adult in a family, and rural patients are less likely to have already had their SSN or financial account number leaked in an unrelated breach, which means the marginal exposure from this incident is higher than for an urban patient with extensive prior exposure.

Offered protections

Public reporting on this breach does not specify whether Bigfork Valley offered complimentary credit monitoring or identity-theft protection services in its individual notification letters. The hospital’s public statements describe “resources to protect their personal information” and additional technical and non-technical security evaluations going forward, but the specific offering, term length, and enrollment instructions are documented only in the mailed letter. Anyone who received a letter should check it for an enrollment code and deadline.

Class-action posture

As of this update, no consolidated class action has been publicly filed against Bigfork Valley Hospital. Two plaintiffs’ firms, Strauss Borrelli PLLC and Levi & Korsinsky LLP, announced investigations in early April 2025 and are soliciting affected individuals, which is the typical precursor to a filed complaint in healthcare-breach matters. We will update this page if and when a complaint is docketed.

What to do if you may be affected

• Read your notification letter carefully. It lists the specific data elements exposed for your individual record and any complimentary credit monitoring or identity-theft protection the hospital is offering, along with an enrollment code and deadline. If you have not received a letter and believe you were a patient at Bigfork Valley before November 2024, contact the hospital to confirm.
• Freeze your credit with Equifax, Experian, and TransUnion. It is free, takes about ten minutes per bureau, and is the highest-leverage step against identity theft when SSNs are in scope.
• Watch for Medicare and insurance fraud. Because Medicare and Medicaid numbers and health insurance member IDs were in scope, review your Medicare Summary Notices and insurer Explanation of Benefits statements for services you did not receive.
• Be alert for targeted phishing. Attackers who acquire mailbox contents often use the names of real providers and recent appointment details to craft convincing follow-up emails or calls. Verify any unexpected outreach by calling the hospital directly using a number from its official website.

Sources on this page

• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach.
• HIPAA Journal — Hamilton County (TN) & Bigfork Valley Hospital (MN) Announce Data Breaches — independent reporting on dates, scope, and exposed data elements.
• Strauss Borrelli PLLC — Bigfork Valley Hospital Data Breach Investigation — plaintiffs’-firm investigation notice.
• Healthcare Facilities Today — Bigfork Valley Hospital Falls Victim to Data Breach — industry trade reporting on timeline and remediation.
• Levi & Korsinsky, LLP — Investigation Alert: Bigfork Valley Hospital Data Breach (PIX11/AccessWire) — second plaintiffs’-firm investigation notice.