Klickitat Valley Health Data Breach (February 2025 Kraken Ransomware): 26,339 Affected at Rural Goldendale, WA Hospital, Filed With HHS OCR March 2025

Klickitat Valley Health, the 25-bed critical-access hospital that anchors emergency, primary care, and long-term care for roughly 5,000 residents of eastern Klickitat County, Washington, was compromised between February 18 and February 23, 2025. Forensic investigators determined that an unauthorized actor copied files containing names, addresses, dates of birth, Social Security numbers, health insurance information, medical record numbers, patient account numbers, and care-related details. The Kraken ransomware group later listed KVH on its dark-web leak site, claiming responsibility for the intrusion. The HHS Office for Civil Rights filing on March 14, 2025 records 26,339 affected individuals, a figure substantially larger than the 531-person count carried in early press coverage and consistent with KVH’s full active and historical patient panel for a community of its size.

Timeline

• February 18, 2025. Forensic review later places the unauthorized file copy on this date.
• February 23, 2025. KVH detects unusual activity on its IT systems and immediately initiates containment, engaging outside cybersecurity counsel and forensic specialists.
• March 14, 2025. KVH submits the HIPAA breach notification to the HHS Office for Civil Rights, reporting 26,339 affected individuals in a “Hacking/IT Incident” at a “Network Server.”
• March 24, 2025. KVH publishes its substitute notice of cyber incident on kvhealth.net, mails individual notification letters, and stands up a dedicated breach hotline at 1-855-374-7069 (Monday-Friday, 6 a.m. to 6 p.m. Pacific).
• Late March 2025. The Kraken ransomware group, which made its public debut in February 2025 and is suspected by researchers to be a rebrand of HelloGookie/HelloKitty, lists Klickitat Valley Health on its dark-web leak site. KVH has not publicly confirmed Kraken’s claim, paid any ransom, or disclosed encryption of systems.

What was exposed

Per KVH’s notice of cyber incident and the letters mailed to affected individuals, the data elements involved vary by patient and may include any of the following:

• Full name, address, and date of birth
• Social Security number
• Driver’s license number or state-issued identification number (for a subset of patients)
• Health insurance information
• Medical record number and patient account number
• Care-related information: dates of service, physician names and departments, and diagnosis and treatment information

KVH has stated that no financial account numbers or payment card information were involved. Because Kraken added KVH to its leak site, the exfiltrated files should be treated as publicly exposed rather than merely staged for extortion.

A rural critical-access hospital

Klickitat Valley Health is organized as Klickitat County Public Hospital District No. 1, a public hospital district whose financials are reviewed by the Washington State Auditor’s Office. The hospital operates 25 acute-care beds, a family medicine clinic, a wellness and therapy center, and skilled long-term care, with roughly 225 staff serving Goldendale and the surrounding ranching and agricultural communities along the Columbia River Gorge. Several characteristics of this population raise the harm profile of the breach above a typical urban hospital disclosure:

• Small-town overlap. With 26,339 affected individuals against a service-area population of about 5,000 current residents, the affected count covers multi-generational and former patients across decades. In a town the size of Goldendale, that effectively means most adult residents and many former residents now living elsewhere.
• Limited local credit-monitoring fluency. Rural and older patients are less likely to already carry paid credit-monitoring or to have the broadband access and time required to act quickly on a notification letter.
• Driver’s-license exposure for a subset. Drivers in Washington can be re-issued license numbers after a confirmed identity-theft incident, but only if the patient knows to request it; a generic credit freeze does not address license-number misuse.
• Concentrated employer effects. Because KVH is one of the largest employers in eastern Klickitat County, current and former employees and their dependents are likely overrepresented in the affected population, layering employment-related identity exposure on top of patient exposure.

What KVH is offering

KVH is offering complimentary credit monitoring and identity-theft protection services to individuals whose Social Security numbers were involved. The hospital’s notice of cyber incident directs affected individuals to call 1-855-374-7069 (Monday-Friday, 6 a.m. to 6 p.m. Pacific) with questions, and references its Notice of Cyber Incident page for current information. KVH has stated that it is “continually enhancing the security of its electronic systems and the patient data it maintains to help prevent events such as this from occurring in the future,” but has not publicly disclosed the specific remediation steps or third-party security assessments completed since the incident.

Class-action posture

As of this update, no consolidated class-action complaint against Klickitat Valley Health has been confirmed in public dockets, and we have not identified a plaintiffs’ firm that has publicly opened a Klickitat Valley Health investigation. Several factors make a future filing plausible: the gap between the OCR-filed count of 26,339 and the much smaller initial press figure of 531, Kraken’s posting of the exfiltrated data on its leak site, the exposure of Social Security numbers across a rural population, and the standard plaintiffs’-bar interest in ransomware events at health-care defendants. We will update this page if and when a complaint is filed.

What to do if you may be affected

If you received a notification letter from Klickitat Valley Health or believe you, a family member, or a current or former employee may have been a KVH patient:

• Freeze your credit with Equifax, Experian, and TransUnion. It is free, takes about ten minutes per bureau, and is the single highest-leverage step against new-account identity theft.
• Enroll in the complimentary credit monitoring KVH is offering if your letter includes an activation code, and call 1-855-374-7069 (Monday-Friday, 6 a.m. to 6 p.m. Pacific) if you have questions about your letter or did not receive one.
• If your Washington driver’s license number was exposed, request a replacement number from the Washington State Department of Licensing. Standard credit freezes do not cover license-number misuse.
• Watch for medical-identity misuse. Review Explanation of Benefits statements from any private insurer, Medicare, or Apple Health (Washington Medicaid), and request a copy of your medical record summary if you suspect treatment you did not receive.
• Be alert for targeted phishing that references KVH, “Kraken,” or the breach response. Verify any unexpected contact by calling KVH or the hotline above rather than clicking links in emails or texts.
• Keep your notification letter. It documents the specific data elements exposed for you and is the cleanest record if you later need to dispute fraudulent activity or join a class action.

Sources

• Comparitech - Ransomware gang says it hacked Klickitat Valley Health, stole SSNs and PHI
• HIPAA Journal - Healthcare Data Breaches Reported in Georgia, Washington & New Hampshire
• Columbia Gorge News - Cyber incident reported at KVH
• teiss - Cyber attack on Klickitat Valley Health compromised patients’ sensitive information
• Klickitat Valley Health - Notice of Cyber Incident
• HHS Office for Civil Rights Breach Portal