How do I know if I am affected by the Northwoods Surgery Center data breach?

Northwoods Surgery Center is mailing notification letters directly to affected individuals. If you have received care or services from Northwoods Surgery Center in the period leading up to November 2025 and you have not received a letter, contact the entity directly. 5,385 individuals were confirmed affected in the HHS OCR filing.

What data was exposed in the Northwoods Surgery Center breach?

According to the notification letter and supporting filings, the compromised data included: Full name, Home address, Date of birth, Health insurance information, Patient medical record number, Treating physician name, Practice type, Date(s) of service, Medication information, Diagnosis and treatment information, Medical claims / billing information.

Was Northwoods Surgery Center attacked by a ransomware group?

No threat actor has publicly claimed responsibility for the Northwoods Surgery Center breach. The incident is categorized in the HHS OCR portal as a hacking.

Should I file a lawsuit over the Northwoods Surgery Center data breach?

1 plaintiffs' firms have publicly announced investigations or filed complaints related to the Northwoods Surgery Center breach: Shamis & Gentile P.A. (publicly investigating). We are not a law firm and cannot give legal advice; consult your own attorney to evaluate your options.

What is HealthConsent and how does it help with the Northwoods Surgery Center breach?

HealthConsent is an independent health-data privacy service. We help affected individuals stop the ongoing flow of their health information by filing HIPAA restriction requests, FTC Health Breach Notification Rule deletion requests, and state-law deletion requests across providers, insurers, Health Information Exchanges, prescription networks, and data brokers. Credit monitoring offered by Northwoods Surgery Center addresses identity-theft risk; HealthConsent addresses the longer-tail problem of your exposed health data continuing to be sold and shared by other entities downstream.

Active breach tracker Virginia, MN Disclosed November 6, 2025

Northwoods Surgery Center Data Breach 2026: 5,385 Minnesota Ambulatory Surgery Patients Exposed. What To Do

Northwoods Surgery Center, a Virginia, Minnesota ambulatory surgery center joint venture between Fairview Range and Dr. Bridget Sundell, disclosed in November 2025 a July-September 2025 network intrusion exposing names, addresses, dates of birth, health insurance, medical record numbers, treating physician, dates of service, medications, diagnoses, and billing information for 5,385 patients. Complimentary credit monitoring offered. Here is what to do.

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated May 15, 2026 Sources & methodology

Timeline

Jul 11, 2025

Unauthorized network access begins

Sep 8, 2025

Discovery of unauthorized network access

Nov 6, 2025

Substitute HIPAA notice published on entity site

Nov 6, 2025

Disclosed publicly

Jul 11, 2025

Unauthorized network access begins

Sep 8, 2025

Discovery of unauthorized network access

Nov 6, 2025

Substitute HIPAA notice published on entity site

Nov 6, 2025

Disclosed publicly

Data exposed

High-risk identity

Enables financial + identity theft

Date of birth

Health records

Don't expire and can't be reissued

Patient medical record number Medication information Diagnosis and treatment information

Contact & insurance

Phishing + targeted scams

Full name Home address Health insurance information Treating physician name Practice type Date(s) of service Medical claims / billing information

Class actions filed by

These firms have publicly announced investigations. You may be eligible to join. We are not a law firm and cannot give legal advice.

Shamis & Gentile P.A. (publicly investigating)

If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

Accept credit monitoring

It’s the floor of the response. Take it.

Freeze your credit

Free at Equifax, Experian, TransUnion.

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

Review your EOBs

Insurance statements catch medical identity theft early.

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

What happened

Northwoods Surgery Center is a single-site ambulatory surgical center (ASC) at 502 N 6th Avenue W in Virginia, Minnesota, serving the Iron Range region. It operates as a joint venture between Fairview Range (Hibbing) and Dr. Bridget Sundell.

Between July 11 and September 8, 2025, an unauthorized actor accessed Northwoods Surgery Center’s network. The practice discovered the intrusion on or about September 8, 2025. Northwoods published a substitute HIPAA notice on its website on November 6, 2025 and the breach was subsequently listed on the HHS OCR portal in 2026 — confirming 5,385 affected individuals.

No ransomware group has publicly claimed responsibility. No leak-site listing has been observed.

What was stolen

Per the entity’s substitute notice:

Full name, home address, date of birth
Health insurance information
Patient medical record number
Treating physician name
Practice type
Date(s) of service
Medication information
Diagnosis and treatment information
Medical claims / billing information

Social Security numbers and financial account numbers are not enumerated in the public summary, though the notice text itself (PDF) should be reviewed for the complete list applicable to your case.

What Northwoods Surgery Center is offering

The entity engaged third-party forensic specialists, secured its network, and is offering complimentary credit monitoring to affected individuals (specific vendor and duration not visible in public summaries — check your specific notification letter for activation details).

What to do

Enroll in the offered credit monitoring through the activation code in your letter.
Place free credit freezes at all three bureaus as a baseline precaution.
Watch your insurance Explanation of Benefits statements for unfamiliar surgical claims.
Confirm the data elements involved in your case by reading your notification letter — the public summary may not be exhaustive.
Stop the ongoing flow of your surgical-center data. HealthConsent files HIPAA restriction requests so the diagnostic, surgical, and prescription data exposed in this breach is not continuously re-shared.

Continue reading

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.