Pit River Health Service Data Breach 2026: 1,800 Tribal Health Patients Exposed in Northern California. EHR + Dentrix Offline. What To Do

What happened

Pit River Health Service Inc. is a nonprofit ambulatory clinic system founded in 1979, serving the American Indian population of Shasta, Modoc, and Lassen counties in northeastern California. The organization operates two clinic sites — Burney and Alturas — providing medical, dental (Dentrix system), and behavioral health services. The dental program alone serves approximately 1,200 tribal patients.

Around December 1, 2025, Pit River Health Service’s EHR and Dentrix dental systems went offline, with initial public notice that systems were unavailable. On December 17, 2025, Pit River publicly confirmed data theft. The HHS OCR filing was made on January 6, 2026 — confirming 1,800 affected individuals.

Pit River has posted three signed cybersecurity letters (January 12, January 22, and February 10, 2026) tracking the restoration progress. The letters are posted as JPG images, not text — body content is not machine-readable from the web.

No ransomware group has publicly claimed responsibility. No leak-site listing has been identified. The operational signature (EHR + Dentrix simultaneously taken offline, multi-week restoration) is consistent with ransomware, but Pit River has not used the word “ransomware” publicly.

What IHS records are carved out

Pit River explicitly stated that the Indian Health Service (IHS) medical record system (RPMS) was not accessed. This carves out the federal IHS records but leaves the entity’s local EHR and Dentrix data in scope.

What was potentially exposed

Per third-party reporting (Claim Depot):

• Patient names
• Contact information
• Medical and dental records
• Possibly administrative data

SSNs, dates of birth, addresses, and government IDs are referenced in aggregator coverage but not officially confirmed by the entity. Tribal enrollment IDs have not been publicly enumerated as in scope.

If you receive a Pit River Health Service notification letter, the letter will list the specific data elements involved in your case.

What Pit River is offering

No credit monitoring service has been publicly named. The entity has advised patients to monitor accounts and consider fraud alerts or credit freezes — self-serve guidance rather than a sponsored offering. No dedicated hotline number is visible in publicly indexed text (notice letters are posted as images).

Tribal sovereignty caveat

Pit River Health Service is a nonprofit 501(c) entity rather than a tribal government instrumentality per se. Sovereign immunity defense against civil suits is plausible but unconfirmed — this would be a focal point of any class action against the organization itself.

What to do

1. Call Pit River Health Service at the Burney or Alturas clinic to ask whether you have been notified and what response is being offered.
2. Read your specific notification letter if you receive one.
3. Place free credit freezes at Equifax, Experian, TransUnion as a baseline precaution.
4. If your tribal enrollment ID was potentially in scope, contact the Pit River Tribe directly about secondary protections.
5. Stop the ongoing flow of your tribal health data. HealthConsent files HIPAA restriction requests covering tribal health, dental, and behavioral health pathways.

Continue reading

• Your eight HIPAA rights, in plain English
• California CMIA: stronger protections than federal HIPAA
• Other 2026 healthcare data breaches