City of St. Joseph, MO Health Department Data Breach 2025: 11,538 Affected · Hacking/IT Incident · MO. Filed With HHS OCR. What To Do.

The City of St. Joseph, Missouri reported on September 22, 2025 that a June 9, 2025 network disruption inside its municipal environment exposed Health Department records covering 11,538 individuals. The City filed the incident with the U.S. Department of Health and Human Services Office for Civil Rights as a Hacking/IT Incident at a network server, and city staff publicly described the underlying event as a ransomware attack.

Timeline

• June 9, 2025. City IT detects a disruption across municipal systems. Networks are taken offline, manual workarounds and emergency Wi-Fi hotspots are stood up for essential services, and external cybersecurity counsel and forensics are engaged.
• June 2025 through early September 2025. Forensic review and electronic data-mining of impacted file shares proceed. The City later reports spending more than $1 million on cybersecurity infrastructure upgrades during and after the response.
• September 4, 2025. The data-mining review concludes. Investigators determine that an unauthorized third party may have acquired files from the Health Department containing protected health information.
• September 19, 2025. The City publishes its substitute notice of the data security incident and stands up a dedicated call center at 1-833-844-5829.
• September 22, 2025. The City files the breach with HHS OCR covering 11,538 affected individuals and confirms in follow-up press coverage that medical diagnosis and treatment information was among the data potentially acquired.

Exposed data

Per the City’s notice, the information that may have been acquired and disclosed includes:

• First and last name
• Date of birth
• Driver’s license number or state identification number
• Passport number
• Social Security number
• Medical diagnosis and treatment information

The notice emphasizes that data elements affected varied individual by individual, and not every person had every element exposed. The City states that the electronic medical records system itself was not impacted.

Why a public-health breach matters

A municipal health department is not a hospital, but the records it holds are unusually sensitive. County and city health-department files routinely include vaccination records, communicable-disease testing and contact-tracing entries, maternal and child health visits, restaurant and food-handler inspections tied to named workers, and case management for HIV, STI, and substance-use programs. Combined with names, dates of birth, and Social Security numbers, those diagnosis-and-treatment notes can produce highly identifying disclosures that are difficult to reverse once published. Public-health populations also skew toward residents who rely on government clinics rather than private providers, which means the breach lands disproportionately on lower-income households and people on Medicaid.

What the City is offering

The City’s notice states that affected individuals will be sent letters that include enrollment instructions for complimentary credit monitoring and identity theft protection services. The City also stood up a dedicated call center at 1-833-844-5829, open 8 a.m. to 8 p.m. ET, Monday through Friday, for affected individuals with questions.

Class action and litigation status

As of this page’s last update, no class-action complaint has been publicly docketed against the City of St. Joseph for this incident. Plaintiff-side firms have begun pre-suit investigations and are soliciting affected residents, which is the usual posture in the weeks after a municipal HIPAA filing of this size. Suits against municipal defendants face Missouri sovereign-immunity defenses that private hospital systems do not, which often shapes both whether a complaint is filed and how it is pleaded.

What to do if you may be affected

• Freeze your credit with Equifax, Experian, and TransUnion. It is free, takes about ten minutes per bureau, and is the single highest-leverage step against new-account identity theft. A freeze is more protective than the credit monitoring being offered, and you can do both.
• Enroll in the credit monitoring and identity-theft protection the City is offering once your letter arrives. Enrollment is free and does not waive any legal claims.
• Watch for a notification letter at the address the Health Department has on file for you. The letter will list the specific data elements that were exposed for you personally, which may be a subset of the full list above.
• If your medical-diagnosis or treatment information was listed, consider asking the Health Department for a copy of the categories of records involved so you know which programs (immunization, communicable disease, maternal/child, etc.) were touched.
• Be skeptical of unsolicited calls, texts, or emails claiming to be from the City of St. Joseph or the Health Department. Use the published call center number above rather than numbers from inbound messages.

Sources on this page

• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach.
• City of St. Joseph — Notice of Data Security Incident — the City’s official substitute notice, including exposed-data list and call center number.
• News-Press NOW — Medical information potentially compromised in City of St. Joseph security breach — September 22, 2025 update confirming medical diagnosis and treatment information was among the data potentially acquired.
• News-Press NOW — City of St. Joseph hit by cyberattack, data potentially acquired in breach — early September 2025 reporting on the incident.
• StateScoop — Cyberattack in St. Joseph, Mo., may have exposed resident data — independent reporting confirming scope and $1M-plus cybersecurity spend.
• KQ2 — Approximately 11,000 individuals’ personal information might be at risk — local broadcast reporting the headline affected-count and ransomware framing.
• DataBreaches.net — MO: City of St. Joseph hit by cyberattack, data potentially acquired — security-trade aggregation of the City’s notice.