HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedPHIIdentity (basic)Government IDHealth (basic)Financial accountCredentialsMediumContained

Shelby County Chris A. Myrtue Medical Center

bd_58ea6517f927c10c · schema v1 · pii pii-v2

Severity

Medium

Discovered

Jun 13, 2025

Filed

Oct 1, 2026

To disclose

—

Affected

5state residents only

Linked

3 filings

Confidence

67%

Shelby County Chris A. Myrtue Medical Center notified patients of unauthorized access to personal and protected health information. The organization became aware of suspicious activity on June 13, 2025, and confirmed data exfiltration following a forensic investigation. Affected data may include names, SSNs, medical records, and financial account information. The entity engaged third-party cybersecurity firms, secured its environment, and is offering credit monitoring and fraud assistance services to impacted individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

Jun 13, 2025

Discovered

Oct 1, 2026

Filed

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Nebraska State AGbd_d90750e200c53e5c2025-09-30 · +366dVerified
Nebraska State AGbd_0643c99859e3942f2025-07-21 · +437dCandidate

Name: Shelby County Chris A. Myrtue Medical Center
norm: shelby county chris a myrtue medical center

Name: Shelby County Chris A. Myrtue Medical Center
norm: shelby county chris a myrtue medical center
Industry: Healthcarellm

Discovered: Jun 13, 2025
Materiality determined: —
Notification sent: Jun 27, 2025
Affected individuals: 5state-resident count only
Data types: PHIIdentity (basic)Government IDHealth (basic)Financial accountCredentials
Attack vector: Unknown
MITRE ATT&CK: T1041 Exfiltration Over C2 Channel
Threat actor: External

During the incident: Took steps to lock down and secure our environment
Engaged a specialized third-party cybersecurity firm and IT personnel to assist with securing the environment
Conducted a comprehensive forensic investigation to determine the nature and scope of the activity
Engaged a third-party vendor to data mine the data identified by the forensics investigation
Undertook detailed internal review of our records to identify contact information to provide notifications
Proactively began notifying potentially impacted individuals via our website and through notice to the media
Taken additional technical and administrative steps to further enhance the security of our systems and customer data
Changes made: Offering months of access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Providing proactive fraud assistance to help with any questions or in the event of becoming a victim of fraud
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

Nebraska State AGJul 21 · first

Nebraska State AG+71d

Massachusetts State AG+437d · this page

Pattern: first filing Jul 21 (NE), last Oct 1 (MA) — a 437-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1776-shelby-county-chris-a-myrtue-medical-center/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 1, 2026
Raw hash: a92c3b4d3c52b28455bf89a9d7f58ebf58da0e38dc6130e25cc4e79fd5f3a2eb

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityShelby County Chris A. Myrtue Medical Center

Victim entityShelby County Chris A. Myrtue Medical Center

Incidentdiscovered Jun 13, 2025

Stated responseTook steps to lock down and secure our environment

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov