WindRose Health Breach Impacts 33,158 Patients

WindRose Health Network, a nonprofit community health center in Indiana that serves nearly 20,000 patients annually, disclosed a data breach that affected approximately 33,158 individuals in the United States.

On Aug. 4, 2026, WindRose Health Network was informed by one of its vendors about a previously undisclosed vulnerability in a remote-management tool. The vendor maintained and used this tool to access parts of WindRose Health Network's computer network.

Upon discovering the incident, the organization took steps to secure its environment and began working with cybersecurity experts to investigate.

Based on the investigation, the organization believes an unauthorized third party used the vulnerability to gain access to one of its servers. The unauthorized access took place between Aug. 3 and Aug. 4, 2026. WindRose Health Network stated in its notification that the incident did not have any impact on the systems that host its electronic medical records.

The types of information exposed included patient names, patient identification numbers, health insurance information, dates of service and the names of medical providers.

The breach was reported to the U.S. Department of Health and Human Services on Sept. 16, 2026. The organization also posted a notice on its website.

WindRose Health Network's response to the breach

The organization encouraged individuals to remain vigilant for unauthorized financial activity by reviewing their account statements and free credit reports, according to its notification. It also recommended that affected individuals consider placing a fraud alert or security freeze on their credit files, which can be done for free.

For individuals with questions about the incident, WindRose Health Network has set up a dedicated phone line. Affected individuals can call 888-619-1168 to speak with a representative.