Central District Health Department of Nebraska Data Breach 2025: 58,519 Affected · Medusa Ransomware · 84 GB Exfiltrated

What happened

Central District Health Department of Nebraska (CDHD) is the local public health agency serving Hall, Hamilton, and Merrick Counties from its main office at 1137 S Locust St in Grand Island. According to its 2024-2025 Annual Report, CDHD employs 47 staff and serves approximately 79,563 residents across its three-county district. Its programs include immunization clinics (18,300 vaccinations administered in the most recent reporting year), communicable-disease control, WIC nutrition services, environmental health, and behavioral health outreach. The department also operates a school-age lead-screening program and an air-quality monitoring network. Because CDHD holds public health records spanning its entire service population, a network intrusion affects a broad cross-section of residents: patients who received vaccinations, individuals in communicable-disease surveillance programs, WIC participants, and clients of environmental-health inspections.

An unauthorized party accessed CDHD’s network environment on February 1, 2025. CDHD immediately engaged a specialized third-party forensic incident response firm and took steps to secure the network. Approximately eleven days later, on February 12, 2025 at 23:39 UTC, the Medusa ransomware group listed CDHD on its dark-web leak site, claiming roughly 84.40 GB of exfiltrated data and demanding a $320,000 ransom. Medusa is a Ransomware-as-a-Service (RaaS) group that employs a double-extortion model: it both encrypts victim systems and threatens to publish stolen data unless paid. The FBI and CISA jointly issued a StopRansomware advisory on Medusa in March 2025, noting the group had compromised more than 300 organizations across critical infrastructure sectors, including healthcare, as of February 2025.

The forensic and document review concluded on June 26, 2025. CDHD determined that personal and protected health information for 58,519 individuals had been potentially acquired. A substitute notice was published on cdhd.ne.gov and individual notification letters began mailing on July 14, 2025. The HHS Office for Civil Rights breach filing is dated April 1, 2025, and classifies the event as a Hacking/IT Incident affecting a Network Server. The Medusa leak-site entry remains indexed on ransomware tracking platforms, indicating the exfiltrated archive was made available to threat actors regardless of whether the ransom was paid.

What was stolen

According to CDHD’s substitute notice, the data elements potentially affected vary by individual and include:

• First name and last name
• Date of birth
• Social Security number
• Protected health information (PHI)

CDHD has not publicly enumerated the specific PHI sub-categories (for example, diagnosis codes, immunization records, treatment details, or insurance identifiers). Given the breadth of CDHD’s programs, records at risk may span communicable-disease surveillance, immunization histories, WIC enrollment data, and environmental-health case files, but this is contextual inference, not confirmed disclosure. Rely on the data elements listed in your individual notification letter for the confirmed facts about your record.

What CDHD is offering

CDHD is offering affected individuals 12 months of complimentary credit monitoring and identity-theft protection services at no cost. Enrollment instructions are included in the individual notification letters.

CDHD has established a dedicated incident-response phone line:

• Phone: 1-833-380-5601
• Hours: Monday through Friday, 8:00 a.m. to 8:00 p.m. ET (excluding U.S. holidays)

CDHD’s notice states: “CDHD has no reason to believe that any individual’s information has been misused as a result of this event.” That statement does not change the fact that the data was published on a ransomware leak site and made available to threat actors.

Class actions and regulatory posture

No class-action lawsuit specifically captioned against Central District Health Department of Nebraska has been publicly reported in the sources reviewed as of this page’s last update.

One Nebraska-specific legal development is worth noting. Nebraska Governor Jim Pillen signed Legislative Bill 241 (LB241) on March 17, 2025, which limits class-action liability for cybersecurity events against private entities to cases involving willful, wanton, or gross negligence. However, LB241 expressly covers only private entities. CDHD is a government agency, so LB241 does not provide it class-action immunity. Standard common-law negligence standards would apply to any civil claims brought against a public health department in Nebraska.

The HHS OCR breach-portal entry remains in open / under-investigation status. The Nebraska Attorney General’s office tracks data-breach activity; any CDHD-related state enforcement filings would surface at ago.nebraska.gov if and when opened.

What to do

1. Enroll in the offered credit monitoring. Use the enrollment code included in your CDHD notification letter and activate it at the vendor portal identified in the letter. The 12-month window applies from the enrollment deadline, not from today.
2. Freeze your credit at all three bureaus: Equifax, Experian, and TransUnion. Social Security numbers were exposed and the data was confirmed posted to a ransomware leak site. A freeze is free, reversible, and materially stronger protection than monitoring alone.
3. File for an IRS Identity Protection PIN (Form 15227, or online at irs.gov/ippin). This is one of the strongest available defenses against tax-refund fraud from a stolen SSN.
4. Watch for medical identity theft. Review every Explanation of Benefits statement from your health insurer and any Medicare Summary Notice. The higher-impact downstream harm from a public-health-department breach is fraudulent medical claims billed in your name, not just credit-card fraud.
5. Be alert to targeted phishing. Threat actors holding your name, date of birth, Social Security number, and Grand Island / CDHD context can craft convincing impersonation calls or emails referencing your health department interactions. Verify any inbound contact independently before providing information or clicking links.
6. Call 1-833-380-5601 with case-specific questions. Have your notification letter ready when you call.
7. Stop the ongoing flow of your public health records. HealthConsent files HIPAA restriction requests so the health and demographic data exposed in this breach is not continuously re-shared across health information exchanges and insurance networks.

Continue reading

• Your HIPAA Rights — how to request restrictions on disclosures of your health information
• All tracked breaches — full index of healthcare data breach pages on HealthConsent