Penobscot Valley Hospital Breach Exposes PHI and PII

Penobscot Valley Hospital, a non-profit, 25-bed critical access hospital in Lincoln, Maine, announced a data breach involving the personal and health information of certain patients and employees.

The total number of individuals affected in the United States has not been publicly disclosed, but at least 49 Vermont residents were identified as affected by the breach.

On Jan. 28, 2026, Penobscot Valley Hospital was alerted to suspicious activity in its information technology environment, according to the company's notification. An investigation followed over the next several months to determine the nature and scope of the incident.

On Feb. 12, 2026, the investigation determined that an unauthorized individual may have accessed certain files and folders within the hospital's systems. The review continued as work was done to identify exactly what type of information may have been involved.

On June 4, 2026, the investigation determined that personal information and protected health information may have been contained in the files affected by the incident. This means it took more than four months from the initial detection of suspicious activity to fully understand the scope of the data involved.

The types of information exposed varied by individual but could have included names, addresses, dates of birth, Social Security numbers, medical information related to visits to Penobscot Valley Hospital, credit and debit account information and financial account codes.

The hospital posted a notice about the incident on its website.

Penobscot Valley Hospital's response to the breach

Penobscot Valley Hospital is offering complimentary identity monitoring services to affected individuals. Given the sensitive nature of the information involved, including Social Security numbers and financial account data, this monitoring can serve as an important tool for detecting potential misuse of personal information.

Individuals who have questions about the incident are encouraged to contact their healthcare provider or health plan directly.