Murray County Medical Center Data Breach 2026: 5,073 Minnesota Rural Hospital Patients Exposed. What To Do
Murray County Medical Center (MCMC), a 25-bed county-owned critical access hospital in Slayton, Minnesota, disclosed in March 2026 an August 2025 network intrusion with 5+ months dwell time. Names, Social Security numbers, driver's licenses, dates of birth, health insurance, and medical treatment history for 5,073 individuals exposed. Kroll-assisted response and credit monitoring offered. Here is what to do.
You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.
Timeline
Aug 21, 2025
Suspicious activity first detected in IT systems
Aug 21, 2025
Attacker gained access
Jan 27, 2026
Forensic review confirms unauthorized access to patient/employee data
Mar 4, 2026
Public notification issued; OCR breach portal listing
Mar 4, 2026
Disclosed publicly
Aug 21, 2025
Suspicious activity first detected in IT systems
Aug 21, 2025
Attacker gained access
Jan 27, 2026
Forensic review confirms unauthorized access to patient/employee data
Mar 4, 2026
Public notification issued; OCR breach portal listing
Mar 4, 2026
Disclosed publicly
Data exposed
01
High-risk identity
Enables financial + identity theft
02
Health records
Don't expire and can't be reissued
03
Contact & insurance
Phishing + targeted scams
Your action plan, in five steps.
You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.
01
Accept credit monitoring
It’s the floor of the response. Take it.
02
Freeze your credit
Free at Equifax, Experian, TransUnion.
03
File IRS Form 14039
Prevent fraudulent tax return under your SSN.
04
Review your EOBs
Insurance statements catch medical identity theft early.
05
Stop the ongoing flow
Credit monitoring doesn’t cover your health records. HealthConsent does.
What happened
Murray County Medical Center (MCMC) is a 25-bed county-owned critical access hospital in Slayton, Minnesota — population approximately 8,000, in rural Murray County in southwest Minnesota. MCMC is a Level IV Trauma and acute-stroke-ready facility, employs roughly 150-200 staff, and was named a 2023 Chartis Top 100 Critical Access Hospital.
On August 21, 2025, MCMC’s IT systems first detected suspicious activity. The forensic review concluded on January 27, 2026, confirming unauthorized access to patient and employee data — a 5+ month dwell time between detection and confirmation, consistent with under-resourced rural-hospital incident-response capacity. MCMC issued public notification in early March 2026 and the breach was listed on the HHS OCR portal — confirming 5,073 affected individuals.
The entity’s notice attributes the intrusion to an “unknown actor.” No ransomware group has claimed responsibility publicly; no dark-web leak-site posting has been identified.
Rural hospital context
Critical access hospitals like MCMC operate on thin margins (federal cost-based Medicare reimbursement plus county subsidy), with limited dedicated cybersecurity staffing. The rising 2024-2026 trend of attackers targeting rural CAHs aligns with this incident’s profile — HHS HC3 advisories and AHA rural-cyber warnings have flagged this pattern.
What was stolen
Per the entity’s notice (varies by individual):
- Full name
- Social Security number
- Driver’s license / state ID number
- Date of birth
- Health insurance information
- Medical treatment and/or medical history information
What MCMC is offering
- Kroll-operated assistance line: (844) 443-1669 (Monday to Friday, 9:00 a.m. to 6:30 p.m. Eastern)
- HIPAA Journal reports complimentary credit monitoring and identity-theft protection included in mailed notification letters — read your specific letter for vendor and duration details.
What to do
- Enroll in the offered credit monitoring and identity-theft protection through the activation code in your letter.
- Place free credit freezes at Equifax, Experian, TransUnion. Full SSN is in scope.
- File IRS Form 14039.
- Watch your insurance Explanation of Benefits statements for unfamiliar hospital claims.
- Stop the ongoing flow of your hospital data. HealthConsent files HIPAA restriction requests so the demographic, hospital, and treatment data exposed in this breach is not continuously re-shared.
Continue reading
Credit monitoring covers your wallet. HealthConsent covers your health records.
Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.
Protect my health dataCancel anytime · Family plan covers spouses + dependents
Sources & further reading
- Murray County Medical Center: Notice
- HIPAA Journal: Murray County Medical Center Coverage (March 2026)
- HHS OCR Breach Portal
Official HHS OCR Breach Portal: ocrportal.hhs.gov
About this page
This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.