Lake Region Healthcare Data Breach Exposes Social Security Numbers and Health Information

Lake Region Healthcare Corp., a community-owned, nonprofit rural health system headquartered in Fergus Falls, Minnesota, disclosed a data breach that exposed sensitive personal and medical information belonging to consumers in multiple states. So far, 294 Texas residents and 20 Massachusetts residents were impacted.

The breach was reported to the Massachusetts Office of Consumer Affairs and Business Regulation and to the Texas Attorney General starting on July 1, 2026. The company also posted a notice of the data security incident on its website.

The breach exposed a broad range of sensitive consumer information, including both personally identifiable information (PII) and protected health information (PHI).

The PII exposed included names, addresses, contact information, dates of birth, Social Security numbers, financial information and government-issued identification numbers.

The PHI exposed included medical and treatment information, health insurance information, medical record numbers and patient account numbers.

Lake Region Healthcare's response to the breach

Lake Region Healthcare is notifying affected individuals by letter sent through U.S. Mail.

The company's notification to affected individuals includes detailed guidance on protecting against financial identity theft and medical identity theft. The notification also advises reviewing Explanation of Benefits statements from health insurance companies for any unrecognized items and following up with the insurance company or care provider regarding any unfamiliar charges.

The notification further recommends contacting the care provider listed on any unfamiliar Explanation of Benefits statement and requesting copies of medical records from the date of potential unauthorized access through the current date. It also suggests asking the insurance company for a current year-to-date report of all services paid for the affected individual as a beneficiary and reviewing it for any unrecognized charges.

For more information about medical identity theft, the notification directs consumers to resources from the Federal Trade Commission.