Cottage Hospital Data Breach Exposes Protected Health Info & SSNs

On Jan. 27, 2026, Cottage Hospital discovered a data breach that impacted 2,156 individuals across the United States, including 1,138 residents of New Hampshire, 83 of Maine, 62 of Massachusetts.

The incident involved unauthorized access to the hospital’s computer network, specifically targeting one file server. The breach occurred between Oct. 14, 2025, and Oct. 21, 2025, but was not discovered until December 8, 2025.

The files accessed by the unauthorized party contained a wide range of sensitive information, including names, Social Security numbers, driver’s license numbers and potentially bank account information. For those who were or are patients, medical and health insurance information may also have been exposed.

The incident was disclosed to the attorneys general offices of Maine, Massachusetts, New Hampshire, and Vermont.

The hospital sent written notifications to affected individuals on Feb. 6, 2026, as required by law. They have also posted a notice of the incident on their website.

Cottage Hospital's response

After learning of the breach, Cottage Hospital immediately launched an investigation with the help of third-party cybersecurity experts. The hospital took steps to contain the incident and began a thorough review of the affected files to determine whose information was involved. In response to the breach, the hospital has implemented and continues to evaluate enhanced security safeguards and provides ongoing security training to its employees.

For those affected, Cottage Hospital is offering a complimentary one-year membership to Experian’s IdentityWorks credit monitoring and identity theft protection service. This includes credit monitoring, fraud consultation and identity restoration support. Affected individuals can enroll in these services at no cost, and doing so will not impact their credit score. The hospital has also established a dedicated, toll-free call center at 833-918-4978 to answer questions and provide assistance.

Given the nature of the data involved, it is important for those affected to remain vigilant. Monitoring bank accounts, reviewing credit reports and considering placing a fraud alert or credit freeze with the major credit bureaus are recommended steps. The notification letter to consumers, which includes activation instructions for the credit monitoring service and additional guidance, is available on the Cottage Hospital website.