Huron Regional Medical Center Data Breach Affects 26,141 People

On May 31, 2025, Huron Regional Medical Center (HRMC), based in Huron, South Dakota, detected suspicious activity within its computer network.

After an investigation, including the engagement of legal counsel and third-party forensic specialists, HRMC determined that an unauthorized party had gained access to its systems and copied sensitive data. On Aug. 21, 2025, HRMC identified the individuals whose information was included in the compromised data set.

A ransomware group called BEAST later claimed on the dark web that it stole 800GB of HRMC’s data. This claim has not been confirmed, and HRMC has not named the group or called the attack ransomware.

The types of information exposed in this breach are extensive and include both personally identifiable information (PII) and protected health information (PHI).

The data accessed includes name, address, phone number, date of birth, Social Security number, Medicare number, Medicaid number, financial account information, health insurance details, date(s) and cost of service, lab results, medical diagnostic images, prescription information, and medical diagnosis and treatment information.

Not all data elements were impacted for every individual, but the scope is broad and includes highly sensitive medical and financial information.

HRMC reported the breach to the U.S. Department of Health and Human Services on June 6, 2025, listing 25,398 people affected. A later filing with the Indiana Attorney General lists 26,141 people affected in total, including two Indiana residents. HRMC also told the Montana Attorney General that 20 Montana residents were affected.

HRMC posted a notice on its website.pdf) on Sept. 9, 2025. It reported the breach to the Montana Attorney General the same day.

Huron Regional Medical Center's response

For those affected, HRMC is offering complimentary single-bureau credit monitoring, credit report, and credit score services for twelve months through Cyberscout, a TransUnion company. Impacted individuals have been notified by mail and provided with instructions to enroll in these services.

HRMC has also set up a dedicated assistance line at 833-456-9193, available Monday through Friday from 8 a.m. to 8 p.m. Eastern time, to answer questions and provide support.

HRMC encourages affected people to stay alert. Recommended steps include monitoring credit reports and account statements for suspicious activity, placing fraud alerts or credit freezes with major credit bureaus and notifying financial institutions of the breach.

Lawsuit update

A class action over the breach, _Marrufo v. Huron Regional Medical Center, Inc._, was filed on Sept. 18, 2025, in federal court in South Dakota. The case docket shows the case was still open as of October 2026.