How do I know if I am affected by the Cedar Point Health, LLC data breach?

Cedar Point Health, LLC is mailing notification letters directly to affected individuals. If you have received care or services from Cedar Point Health, LLC in the period leading up to February 2026 and you have not received a letter, contact the entity directly. 23,114 individuals were confirmed affected in the HHS OCR filing.

Was Cedar Point Health, LLC attacked by a ransomware group?

No threat actor has publicly claimed responsibility for the Cedar Point Health, LLC breach. The incident is categorized in the HHS OCR portal as a hacking.

What is HealthConsent and how does it help with the Cedar Point Health, LLC breach?

HealthConsent is an independent health-data privacy service. We help affected individuals stop the ongoing flow of their health information by filing HIPAA restriction requests, FTC Health Breach Notification Rule deletion requests, and state-law deletion requests across providers, insurers, Health Information Exchanges, prescription networks, and data brokers. Credit monitoring offered by Cedar Point Health, LLC addresses identity-theft risk; HealthConsent addresses the longer-tail problem of your exposed health data continuing to be sold and shared by other entities downstream.

Active breach tracker Montrose, CO Disclosed February 12, 2026

Cedar Point Health Data Breach 2026: 23,114 Western Colorado Patients Exposed. Broad PII Incl. Passport + Financial. 12 Months Kroll Monitoring. What To Do

Q: What data was exposed in the Cedar Point Health, LLC breach?

According to the notification letter and supporting filings, the compromised data included: Full name, Home address, Date of birth, Social Security number / ITIN, Driver's license or state ID, Passport number, Financial account information, Health insurance information, Medical / clinical information (diagnoses, procedures, treatment records, clinical notes).

Q: Should I file a lawsuit over the Cedar Point Health, LLC data breach?

2 plaintiffs' firms have publicly announced investigations or filed complaints related to the Cedar Point Health, LLC breach: Strauss Borrelli (publicly investigating), Shamis & Gentile (publicly investigating). We are not a law firm and cannot give legal advice; consult your own attorney to evaluate your options.

Cedar Point Health, a multi-specialty medical group operating seven clinics across western Colorado, disclosed in February 2026 a June 2025 network intrusion exposing names, Social Security numbers, driver's licenses, passport numbers, financial account information, and clinical records for 23,114 patients. 12 months Kroll monitoring offered. Here is what to do.

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated May 15, 2026 Sources & methodology

Timeline

Jun 15, 2025

Earliest date files may have been accessed / exfiltrated

Jun 16, 2025

Unauthorized access detected; network secured; forensics engaged

Jan 27, 2026

Data review concluded; affected individuals identified

Feb 12, 2026

Filed with HHS OCR and Massachusetts AG; individual letters mailed

Jun 15, 2025

Earliest date files may have been accessed / exfiltrated

Jun 16, 2025

Unauthorized access detected; network secured; forensics engaged

Jan 27, 2026

Data review concluded; affected individuals identified

Feb 12, 2026

Filed with HHS OCR and Massachusetts AG; individual letters mailed

Data exposed

High-risk identity

Enables financial + identity theft

Date of birth Social Security number / ITIN Driver's license or state ID Passport number

Health records

Don't expire and can't be reissued

Medical / clinical information (diagnoses, procedures, treatment records, clinical notes)

Contact & insurance

Phishing + targeted scams

Full name Home address Financial account information Health insurance information

Class actions filed by

These firms have publicly announced investigations. You may be eligible to join. We are not a law firm and cannot give legal advice.

Strauss Borrelli (publicly investigating) Shamis & Gentile (publicly investigating)

If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

Accept credit monitoring

It’s the floor of the response. Take it.

Freeze your credit

Free at Equifax, Experian, TransUnion.

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

Review your EOBs

Insurance statements catch medical identity theft early.

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

What happened

Cedar Point Health, LLC is a multi-specialty medical group headquartered in Montrose, Colorado, operating approximately seven facilities across western Colorado (Montrose, Delta, Cedaredge, Grand Junction / Clifton, Ridgway). Services include primary care, urgent care, physical therapy, behavioral health, telehealth, and occupational medicine.

On June 16, 2025, Cedar Point Health detected unauthorized access to its network. The earliest date files may have been accessed or exfiltrated is June 15, 2025. Third-party forensics was engaged. The data review concluded on January 27, 2026. Cedar Point Health filed with HHS OCR and the Massachusetts Office of Consumer Affairs and Business Regulation on February 12, 2026, posted public notice, and began individual mail notifications — confirming 23,114 affected individuals (only 4 Massachusetts residents; cohort overwhelmingly Coloradan).

No ransomware group has been publicly attributed. No leak-site listing has been identified.

What was stolen

The exposed dataset is unusually broad:

Full name, home address, date of birth
Social Security number (or ITIN)
Driver’s license or state ID
Passport number
Financial account information
Health insurance information
Medical / clinical information: diagnoses, procedures, treatment records, clinical notes

The inclusion of passport number and financial account information alongside SSN puts Cedar Point Health’s exposure profile closer to a payer or BA breach than a typical clinic breach — likely reflecting registration intake practices for non-US-citizen patients in the western CO area.

What Cedar Point Health is offering

Complimentary identity-theft protection via Kroll for individuals whose SSNs were involved
Includes single-bureau credit monitoring, fraud consultation, and identity-theft restoration
Dedicated call center: (844) 443-0831 (7:00 a.m. to 4:30 p.m. Mountain, Monday to Friday)

What to do

Enroll in Kroll through the activation code in your letter.
Place free credit freezes at all three bureaus. Full SSN + driver’s license + passport is among the most complete identity-document sets to expose.
File IRS Form 14039.
If your passport was exposed, monitor for fraudulent travel-document or identity-substitution activity. There is no central freeze for passport numbers.
Cancel and reissue any payment cards or bank cards that may be tied to financial account information in your Cedar Point Health record.
Stop the ongoing flow of your healthcare data. HealthConsent files HIPAA restriction requests across providers, insurers, HIEs, and prescription networks.

Continue reading

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.