Cache Valley Ear, Nose & Throat Data Breach 2025: 26,469 Patients Exposed in Medusa Ransomware Attack on North Logan ENT · 210 GB Allegedly Exfiltrated

Cache Valley Ear, Nose & Throat, a North Logan, Utah ENT practice, identified unusual activity in its email environment on February 4, 2025, and engaged outside legal counsel and third-party forensic specialists to investigate. The Medusa ransomware group subsequently listed the practice on its data-leak site in mid-February 2025, claiming roughly 210.10 GB of exfiltrated data. The HIPAA breach notification was filed with the U.S. Department of Health and Human Services Office for Civil Rights on April 24, 2025, reporting 26,469 affected individuals in a Hacking/IT Incident at a Network Server. The forensic data-review process did not conclude until November 4, 2025, and individual notification letters were not mailed until November 21, 2025, more than nine months after the intrusion was first detected.

State attorney-general filings in New Hampshire, Massachusetts, and Rhode Island confirm that Cache Valley ENT considers the exposed data set to include names, addresses, provider names, drug names, and health-insurance information. The substitute notice does not claim that Social Security numbers or financial-account data were involved, but Medusa is a double-extortion operator that exfiltrates large mailbox and file-share data sets before encryption, so individuals should treat the public characterization as a floor rather than a ceiling.

Timeline

• February 4, 2025 — Cache Valley ENT identifies unusual activity in its email environment, engages outside legal counsel and forensic specialists, and begins investigation.
• February 13, 2025 — Medusa ransomware group reportedly lists Cache Valley ENT on its data-leak site, claiming approximately 210.10 GB of exfiltrated data.
• April 24, 2025 — HIPAA breach notification filed with HHS OCR for 26,469 individuals, classified as Hacking/IT Incident at Network Server.
• November 4, 2025 — Forensic review of impacted data concludes; affected-individual list compiled.
• November 21, 2025 — Cache Valley ENT mails individual notification letters, posts a substitute notice on its website, and notifies state attorneys general in New Hampshire, Massachusetts, and Rhode Island.

What was exposed

Per the substitute notice and state attorney-general filings, the data elements identified as exposed include:

• Name
• Address
• Provider name
• Drug name (medication information)
• Health insurance information

The substitute notice does not list Social Security numbers, dates of birth, financial-account numbers, or full clinical records. Because Medusa exfiltrated approximately 210 GB and the full content of the staged leak is not publicly enumerated, individuals should assume that mailbox-resident attachments (referrals, claim correspondence, insurance card images, prescription histories) may be in the threat actor’s possession even where not formally listed.

What Cache Valley ENT is offering

Affected individuals are being offered complimentary credit monitoring and identity-theft protection services through Cyberscout (a TransUnion company), with the duration set at 12 or 24 months depending on state of residence. The notification letter contains a single-use enrollment code and a dedicated incident-response phone line. Cache Valley ENT also states it has reviewed its policies and procedures and implemented additional safeguards in its email environment.

Class-action and regulatory posture

As of the date this page was last updated, no class-action lawsuit against Cache Valley Ear, Nose & Throat has been publicly filed or docketed in the law-firm investigation trackers reviewed for this entry. The HHS OCR portal entry is open and under federal review. Given the affected count, the nine-month gap between detection and individual notification, and the Medusa data-leak posting, plaintiff-side investigations are likely; this page will be updated if a complaint is filed.

What to do if you may be affected

• Enroll in the offered monitoring using the single-use code in your notification letter. Credit-monitoring enrollment is free and detects new-account openings on your file.
• Freeze your credit with Equifax, Experian, and TransUnion. A freeze is materially stronger than monitoring alone and is free and reversible.
• Treat targeted phishing as the primary near-term risk. A practice-specific email and document set in the hands of a sophisticated ransomware crew means scams that reference your provider, your medication, or your insurer are plausible. Do not provide payment or account details over the phone to anyone calling about this breach.
• Review your Explanation of Benefits statements from your health insurer for services you did not receive. Medical identity theft can take months to surface and is the most common downstream harm where insurance information is exposed.
• Verify all post-breach outreach. Legitimate notification letters reference Cyberscout/TransUnion enrollment and a specific Cache Valley ENT incident phone line. If you receive contact from a self-styled “settlement administrator” before any court filing, treat it as suspicious.

Sources

• HHS Office for Civil Rights Breach Portal — federal regulatory record (filing dated 2025-04-24, 26,469 individuals, Hacking/IT Incident, Network Server).
• Cache Valley ENT — Official Notice of Data Privacy Event — entity’s substitute notice posted November 2025.
• New Hampshire Attorney General — Cache Valley ENT Breach Notification Filing — state AG filing dated November 21, 2025.
• HIPAA Journal — Health Plan Members’ PHI Exposed in Cyberattack on Fieldtex Products (Cache Valley ENT section) — discovery date, exposed-data list, credit-monitoring details.
• ClaimDepot — Cache Valley ENT Discloses Data Breach to Multiple State Attorneys General Offices — multi-state AG filing summary and remediation offering.
• BreachSense — Cache Valley ENT Data Breach in 2025 — threat-actor attribution and leak-size data point.
• RedPacket Security — Medusa Ransomware Victim: Cache Valley ENT — Medusa leak-site posting and 210.10 GB exfiltration claim.