Heywood Healthcare Data Breach Impacts 8k: PHI Exposed

Heywood Healthcare Inc, a nonprofit health system serving north central Massachusetts and southern New Hampshire, disclosed a data breach affecting thousands of individuals.

Between Oct. 8 and Oct. 12, 2025, an unknown third party accessed certain systems on the network and acquired files from those systems.

Heywood Healthcare discovered suspicious activity on Oct. 12, 2025, and began an internal investigation.

The attack caused disruptions across the health system. As reported by Healthcare Info Security, IT systems were taken offline, and both Heywood Hospital and Athol Hospital stopped accepting emergency patients transported by ambulance. Radiology, laboratory and CT scan imaging services were also affected. Email and phone systems were disrupted as well.

On Nov. 19, 2025, a ransomware group known as Sinobi claimed responsibility for the attack on a dark web forum hosted on the Tor network. The group stated it had obtained 550 GB of the organization's data, including customer records, financial information, internal contracts and other confidential documents. The group threatened to publish the data within three days.

The investigation, which included work by a third-party forensic security firm, determined on June 3, 2026, that the compromised files contained personal information belonging to affected individuals.

The exposed information included both personally identifiable information and protected health information including names, dates of birth, driver's license numbers, financial account numbers, passport numbers, Social Security numbers, tax identification numbers, government ID numbers, health insurance information, medical information and medical records.

The breach was reported to the U.S. Department of Health and Human Services on Dec. 12, 2025, and to state regulators in Massachusetts, New Hampshire and Vermont. The organization also posted a notice about the incident on its Facebook page on Oct. 16, 2025.

The breach so far impacted 500 Massachusetts residents, 7,087 New Hampshire residents and 516 Vermont residents. Heywood Healthcare began notifying affected consumers by mail on Dec. 10, 2025, with additional notifications sent on Sept. 10, 2026.

Heywood Healthcare's response to the breach

Heywood Healthcare is offering affected individuals complimentary credit monitoring, fraud consultation and identity theft restoration services through Kroll. Individuals who received a notification letter can enroll by visiting Kroll's enrollment page and using the membership number included in their letter. The enrollment deadline is listed in each individual's notification.

The company has also set up a dedicated toll-free call line to answer questions about the incident. The call line is available from 9 a.m. to 6:30 p.m. Eastern Time, Monday through Friday, excluding major U.S. holidays. The phone number and membership number are included in the notification letter mailed to affected individuals.