How do I know if I am affected by the Cedar Valley Hospice data breach?

Cedar Valley Hospice is mailing notification letters directly to affected individuals. If you have received care or services from Cedar Valley Hospice in the period leading up to March 2026 and you have not received a letter, contact the entity directly. 10,666 individuals were confirmed affected in the HHS OCR filing.

What data was exposed in the Cedar Valley Hospice breach?

According to the notification letter and supporting filings, the compromised data included: Full name, Social Security number, Driver's license information, Health information, Financial account information.

Was Cedar Valley Hospice attacked by a ransomware group?

No threat actor has publicly claimed responsibility for the Cedar Valley Hospice breach. The incident is categorized in the HHS OCR portal as a hacking.

Should I file a lawsuit over the Cedar Valley Hospice data breach?

As of the latest update, no class action complaints have been publicly filed against Cedar Valley Hospice for this breach. Plaintiffs' firm interest may develop. We are not a law firm and cannot give legal advice.

What is HealthConsent and how does it help with the Cedar Valley Hospice breach?

HealthConsent is an independent health-data privacy service. We help affected individuals stop the ongoing flow of their health information by filing HIPAA restriction requests, FTC Health Breach Notification Rule deletion requests, and state-law deletion requests across providers, insurers, Health Information Exchanges, prescription networks, and data brokers. Credit monitoring offered by Cedar Valley Hospice addresses identity-theft risk; HealthConsent addresses the longer-tail problem of your exposed health data continuing to be sold and shared by other entities downstream.

Active breach tracker Waterloo, IA Disclosed March 6, 2026

Cedar Valley Hospice Data Breach 2026: 10,666 Iowa Hospice Patients Exposed. SSN + Driver's License + Financial Data in Scope. What To Do

Cedar Valley Hospice, Northeast Iowa's largest hospice and palliative-care nonprofit since 1979, disclosed in March 2026 a November 2025 network intrusion exposing names, Social Security numbers, driver's licenses, health information, and financial account information for 10,666 patients and family caregivers. End-of-life context. 12 months Kroll monitoring offered. Here is what to do.

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated May 15, 2026 Sources & methodology

Timeline

Nov 11, 2025

Suspicious network activity detected; environment isolated

Nov 11, 2025

Attacker gained access

Nov 19, 2025

Forensics confirms unauthorized data viewing / download

Nov 19, 2025

Breach detected

Dec 30, 2025

Document review complete

Feb 23, 2026

Final notification list compiled

Mar 4, 2026

Notification letters mailed

Mar 6, 2026

Filed with Iowa AG and HHS OCR

Data exposed

High-risk identity

Enables financial + identity theft

Social Security number Driver's license information

Contact & insurance

Phishing + targeted scams

Full name Health information Financial account information

If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

Accept credit monitoring

It’s the floor of the response. Take it.

Freeze your credit

Free at Equifax, Experian, TransUnion.

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

Review your EOBs

Insurance statements catch medical identity theft early.

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

What happened

Cedar Valley Hospice is Northeast Iowa’s largest hospice and palliative-care nonprofit, founded in 1979 and headquartered in Waterloo. The patient population includes terminally ill individuals, family caregivers receiving bereavement services, and children of decedents enrolled in grief programs.

On November 11, 2025, Cedar Valley Hospice detected suspicious network activity and isolated the environment. Forensic investigation on November 19, 2025 confirmed that an unauthorized third party had viewed or downloaded patient data. The document review concluded December 30, 2025. Cedar Valley Hospice mailed notification letters on March 4, 2026 and filed with the Iowa AG and HHS OCR on March 6, 2026 — confirming 10,666 affected individuals (Iowa AG filing cites 15,347 Iowa residents; the OCR figure is the authoritative federal count and the discrepancy likely reflects different counting methodology between filings).

No threat actor has been publicly identified. No leak-site listing has been observed.

What was stolen

The Iowa AG filing letter (signed by Martin McElligott of Wilson Elser) lists:

Full name
Social Security number
Driver’s license information
Health information
Financial account information

This is among the most sensitive PHI combinations exposed in 2026 — SSN + DL + medical + financial together support identity theft, medical identity theft, and financial-account fraud. Hospice care notes can additionally contain prognosis, diagnosis, and medication detail for terminally ill patients.

End-of-life context

The affected population includes decedents and their surviving spouses and children. Decedents’ Social Security numbers are particularly high-value to fraudsters: deceased SSNs are not flagged for approximately six months after death by the Social Security Administration, creating a window for tax-refund fraud and synthetic-identity creation. Surviving spouses face elevated post-loss fraud risk during a period when they are typically not monitoring identity-theft signals.

What Cedar Valley Hospice is offering

12 months of complimentary credit monitoring + identity-theft protection via Kroll
Enrollment: enroll.krollmonitoring.com
Dedicated call center: (844) 443-1312
Minor Identity Monitoring offered separately for affected children
Incident counsel: Wilson Elser Moskowitz Edelman & Dicker LLP

What to do

Enroll in Kroll through the activation code in your letter.
For decedent SSNs, file IRS Form 14039 on behalf of the deceased and notify the Social Security Administration to flag the SSN.
Place free credit freezes at all three bureaus for any affected family member, including minors.
File IRS Form 14039.
Stop the ongoing flow of hospice and end-of-life data. HealthConsent files HIPAA restriction requests so the prognosis, diagnosis, and demographic data exposed in this breach is not continuously re-shared.

Continue reading

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.