Cumberland County Hospital Association (CCH) has discovered a major data breach. The cybersecurity incident began on February 21, 2025, and continued undetected until April 3, 2025.
36,659 people have been affected, according to a disclosure filed with the Department of Health and Human Services on June 2nd.
Files containing sensitive information were accessed during the breach, compromising both personally identifiable information (PII) and protected health information (PHI). The types of information exposed for current and former patients and employees may include: name, date of birth, address, phone number, email address, race or ethnicity, Social Security number, medications, diagnoses, treatment notes, dates of service, medical record number, health plan number, and claims and billing information.
Current and former employees may have also had driver’s license, birth certificate, background check details, W-4s and W-2s, and bank account numbers compromised in the data breach.
The data breach was disclosed to the New Hampshire Attorney General’s office on June 2, 2025, reporting 4 impacted New Hampshire residents. CCH mailed notifications to affected individuals and posted a Notice of Data Breach on its own website.
Cumberland County Hospital is providing 12 months of free identity monitoring services through Kroll. The cybersecurity incident was reported to the New Hampshire Attorney General's office, and impacted current and former patients and employees have been notified by mail.
If you were notified or believe your personal or protected health information may have been compromised in the Cumberland County Hospital breach:
Cumberland County Hospital has provided a toll free number for current and former patients and employees that may have questions: 1-866-461-3127, Monday through Friday, 8:00 a.m. to 5:30 p.m. Central Time.
For more information about the hospital, you can visit the Cumberland County Hospital Association website.