Cottage Hospital Data Breach 2026 (Qilin Ransomware): 2,156 New Hampshire Critical Access Hospital Patients and Employees Exposed. What To Do

What happened

Cottage Hospital is a 25-bed independent nonprofit critical access hospital in Woodsville, New Hampshire (Grafton County, North Country region). The hospital serves the Connecticut River Valley and Upper Valley on the NH/VT border. Services include ER, inpatient med/surg, surgery, obstetrics, rehab, and rural primary care clinics. Cottage is not part of a larger health system; its service area straddles NH and VT.

Between October 14 and 21, 2025, the Qilin ransomware group accessed a Cottage Hospital file server. The hospital learned of the intrusion on December 8, 2025. The forensic review was completed on January 27, 2026, and Cottage Hospital mailed notification letters and filed with HHS OCR, NH AG, and VT AG on February 6, 2026 — confirming 2,156 affected individuals total.

State-level breakdown per AG filings: 1,138 NH residents, 83 ME residents, 62 MA residents, plus unspecified VT and other-state residents.

Note on the affected count: HHS OCR shows 1,005 individuals for this filing. The discrepancy with the 2,156 total reflects HIPAA scope — the HHS figure covers only the HIPAA-covered (patient-PHI) subset; the larger 2,156 includes employee and non-patient records that fall under state breach notification but not HIPAA.

Qilin is a Russian-affiliated ransomware-as-a-service group active 2022-present, known for healthcare targeting (Synnovis/NHS in 2024, and others). Qilin operates a data-theft plus encryption double-extortion model.

Who was affected

This breach primarily affects current and former Cottage Hospital employees, plus employee-patients (employees who also received care at the hospital). Specifically:

• Employees and former employees: name, SSN, driver’s license number, bank account information
• Employee-patients: additionally, medical information and health insurance information

The OCR portal categorization as “Network Server” (rather than EMR) is consistent with the employee-focused exposure — payroll, HR, and direct-deposit records were the primary data store breached.

What was stolen

• Full name
• Social Security number
• Driver’s license number
• Bank account information
• Medical information (for employee-patients)
• Health insurance information (for employee-patients)

What Cottage Hospital is offering

• 12 months complimentary Experian IdentityWorks — credit monitoring, fraud consultation, identity restoration
• Enhanced safeguards and employee security training
• Forensic investigation engaged

What to do

1. Enroll in Experian IdentityWorks through the activation code in your letter.
2. Place free credit freezes at Equifax, Experian, TransUnion. Full SSN and driver’s license are in scope.
3. File IRS Form 14039.
4. Cancel and reissue any payment methods tied to the bank account information in scope. ACH theft can be rapid when routing/account numbers are exposed — call your bank to flag the account for unusual activity.
5. Replace your driver’s license if you receive evidence of identity theft using it.
6. If you are a former Cottage Hospital employee, your records are almost certainly in scope — current employment status does not exclude you.
7. Stop the ongoing flow of your hospital employment and care data. HealthConsent files HIPAA restriction requests covering employer-as-covered-entity pathways and rural hospital data flows.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches