Sierra Vista Hospital & Clinics Data Breach 2025: 75,054 New Mexico Patients Exposed After Two-Week Network Intrusion. What To Do

Sierra Vista Hospital & Clinics, the sole community hospital serving Truth or Consequences and the surrounding rural stretch of southern New Mexico, disclosed a two-week January 2025 network intrusion that exposed protected health information for 75,054 individuals. The hospital detected the unauthorized access on January 29, 2025, completed its forensic review on August 13, 2025, and began mailing individual notification letters on October 6, 2025. That is more than eight months between intrusion and patient notice. Multiple plaintiff firms have opened class-action investigations, and Sierra Vista is providing free Experian IdentityWorks credit monitoring to affected individuals.

What happened

Sierra Vista Hospital & Clinics (SVH) is the only hospital in Sierra County, New Mexico. Located at 800 E. 9th Avenue in Truth or Consequences, it operates a 24-hour emergency department, a Rural Health Clinic, a Walk-in Clinic, general surgery consultation, and inpatient and outpatient services for a population that has few alternative providers within reasonable travel distance.

On January 29, 2025, SVH detected unauthorized access to portions of its computer network. Incident response was launched immediately, and external cybersecurity professionals were engaged. The forensic investigation determined that an unauthorized party had accessed the network between January 14 and January 31, 2025. On August 13, 2025, the review concluded that files within the affected network segment contained personal and protected health information. SVH filed its HIPAA breach report with the HHS Office for Civil Rights on October 6, 2025, listing 75,054 affected individuals and Network Server as the breach location. Individual notification mailings and state attorney general filings followed on October 6-10. No ransomware group has publicly claimed responsibility for this incident, and SVH has not attributed the intrusion to a named threat actor in any public filing reviewed.

calHIPAA’s October 2025 healthcare breach report ranked Sierra Vista as the fourth-largest breach reported that month, behind Conduent Business Services (10.5 million), Tri Century Eye Care (200,000), and Central Jersey Medical Center (88,000).

What was stolen

Sierra Vista’s official data security incident notice, published at svhnm.org on October 6, 2025, and the parallel state attorney general filings describe the following data elements as potentially exposed:

• Full name
• Address
• Date of birth
• Social Security number
• Driver’s license number or state identification number
• Medical information (treatment, diagnosis, and clinical records)
• Health insurance information

This is the broad combination — government identifier plus medical history plus insurance — that drives both medical identity theft risk and tax-refund fraud risk. SVH has stated it has no information indicating that exposed data has been used to commit fraud or identity theft as of its notification date.

What Sierra Vista is offering

Sierra Vista is providing affected individuals with complimentary access to Experian IdentityWorks credit monitoring. Identity restoration assistance is available immediately without requiring enrollment. To activate the full fraud detection tools, follow the enrollment instructions in your specific notification letter, including the activation code and enrollment deadline printed on your letter.

The dedicated call center is 855-291-2594, available for 90 days from the date of your letter, Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern time, excluding holidays.

For questions about Experian IdentityWorks specifically, contact Experian’s customer care team at 877-288-8057. A credit card is not required to enroll. Be prepared to provide the engagement number from your letter when calling Experian.

In response to the incident, SVH states it has implemented additional safeguards including increased email filtering, added malware monitoring, and enhanced cybersecurity training for staff.

Class actions

As of this update, no consolidated class action has been reported as filed in U.S. District Court for the District of New Mexico or in New Mexico state court against Sierra Vista Hospital & Clinics. Active class-action investigations have been opened publicly by Federman & Sherwood, Strauss Borrelli PLLC, and Almeida Law Group. ClassAction.org’s affiliated counsel opened an intake investigation in October 2025 and closed it in February 2026, noting that the investigation is complete and directing any remaining questions to local attorneys. Claim Depot affiliated counsel continues intake. nm.news reported in November 2025 that class-action attorneys were preparing suit and soliciting notice recipients.

The HHS OCR entry remains posted on the public portal at 75,054 individuals. OCR has not separately published an investigation or enforcement status.

Sensitive-population context: rural patients

Sierra Vista is the only hospital in Sierra County. For most patients affected by this breach, SVH is not one of several providers in their medical record. It is the provider. That concentration matters when a breach exposes the full identifier stack. Rural patients in this population are statistically more likely to have a single Social Security number tied to Medicare enrollment, more likely to receive notification through a single long-standing mailing address, and less likely to have ready access to identity protection services without significant travel. A credit freeze is the highest-leverage step for this population because it blocks new account fraud automatically, without requiring the patient to monitor every downstream channel.

What to do

The combination of Social Security number, date of birth, driver’s license number, and medical history is high-risk. Plan defenses accordingly.

1. Enroll in Experian IdentityWorks using the activation code and enrollment instructions in your Sierra Vista notification letter. Call 855-291-2594 (90 days from your letter date) if you have questions about your enrollment eligibility or the scope of your coverage.
2. Freeze your credit at Equifax, Experian, and TransUnion. It is free, takes about ten minutes per bureau online, and blocks new account fraud. Do this in addition to the Experian monitoring — the two protect against different attacks.
3. Request an IRS Identity Protection PIN at irs.gov/ippin. When SSNs and dates of birth are exposed together, tax-refund fraud is one of the most common downstream attacks.
4. Watch for medical identity theft. Request copies of your Explanation of Benefits from Medicare, Medicaid, or your private insurer. Verify every listed claim is one you recognize. Report unfamiliar claims to your insurer and to HHS OCR.
5. Replace your driver’s license or state ID through the New Mexico Motor Vehicle Division if your license number was listed in your notification letter. License-number fraud is harder to detect than credit fraud and replacement is inexpensive.
6. Be skeptical of unsolicited outreach referencing the breach. Threat actors routinely follow large healthcare disclosures with targeted phishing using the leaked identifiers. Sierra Vista will not ask for your Social Security number or banking information by phone or email.
7. Stop the ongoing flow of your medical data. HealthConsent files HIPAA restriction requests so the clinical and insurance information exposed in this breach is not continuously re-shared across healthcare networks, clearinghouses, and data brokers. File a restriction request through HealthConsent.

Continue reading

• Your HIPAA rights — what you can restrict and how
• All tracked healthcare data breaches

Sources

• HHS Office for Civil Rights Breach Portal
• Sierra Vista Hospital & Clinics — Data Security Incident Notice (PDF)
• Sierra Vista Hospital & Clinics — official site
• nm.news — Class-action lawsuit looms for hospital after major data breach
• Claim Depot — Sierra Vista Data Breach Exposes SSNs & Medical Info of 75K
• ClassAction.org — Sierra Vista Hospital & Clinics Data Breach
• Strauss Borrelli PLLC — Sierra Vista Hospital & Clinics Data Breach Investigation
• Federman & Sherwood — Sierra Vista Hospital & Clinics Data Breach
• Almeida Law Group — Sierra Vista Hospital & Clinics Data Breach
• New Hampshire AG — Sierra Vista Hospital & Clinics Notice Filing (PDF)
• calHIPAA — Healthcare Data Breach Report for October 2025