Grafton City Hospital Data Breach Affects 1,215 Users

Grafton City Hospital Inc., a nonprofit critical access hospital in Grafton, West Virginia, reported a data breach that affected approximately 1,215 individuals in the United States. The breach was the result of a phishing attack on Monongalia County General Hospital Company (Mon General), an affiliated hospital within the Vandalia Health Mon network.

The breach was disclosed to the U.S. Department of Health and Human Services on Aug. 22, 2026. Mon General also posted a notice of the security incident on its website%20-%20Substitute%20Notice%20(for%20website).docx) to inform individuals who may have been affected.

On May 6, 2026, Mon General discovered that a number of its email users were the subject of a phishing attack. Mon General began investigating the incident with the assistance of a forensic security provider.

The investigation concluded in late June 2026, determining that an unauthorized party gained access to certain Mon General email mailboxes on May 6, 2026. The unauthorized access was discovered and terminated on the same day. No other Mon General systems or data storage were impacted by the incident.

The affected data may have included personally identifiable information and protected health information such as first and last name, date of birth, email address, phone number, Social Security number, health information and health insurance information.

Grafton City Hospital's response to the breach

Mon General is offering affected individuals two years of free credit monitoring to help them detect any unauthorized use of their personal information. Individuals whose information may have been impacted can sign up for this service by following the instructions included in the notification letters that are being mailed to them.

Mon General also encouraged individuals to remain vigilant and to continue reviewing their account statements for any unusual activity.

For individuals who have questions or need more information about the incident, Mon General has set up a dedicated toll-free phone line. Affected individuals can call 844-958-8936 for assistance. The support line is staffed Monday through Friday from 8:00 a.m. to 5:30 p.m. Central Time, excluding major U.S. holidays.