HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumActive

Shelby County Chris A. Myrtue Memorial Hospital

bd_d90750e200c53e5c · schema v1 · pii pii-v2

Severity

Medium

Discovered

Jun 13, 2025

Filed

Sep 30, 2025

To disclose

—

Affected

50state residents only

Linked

3 filings

Confidence

67%

Full breach record for Shelby County Chris A. Myrtue Memorial Hospital →

Shelby County Chris A. Myrtue Memorial Hospital (dba Myrtue Medical Center) reported a cybersecurity incident discovered on June 13, 2025, involving unauthorized access to its computer network. The breach potentially exposed former employees' and dependents' personal information, including names, addresses, Social Security numbers, driver's license numbers, and direct deposit information. Fifty Nebraska residents were affected. The hospital engaged a forensic firm, disconnected remote access, changed credentials, and offered 12 months of credit monitoring. This filing is a supplemental notice to the Nebraska Attorney General.

J jump to incidentP pin to compareR raw source

Incident timeline

Jun 13, 2025

Discovered

Sep 30, 2025

Filed

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Nebraska State AGbd_0643c99859e3942f2025-07-21 · +71dCandidate
Massachusetts State AGbd_58ea6517f927c10c2026-10-01 · +366dVerified

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: Shelby County Chris A. Myrtue Memorial Hospital
norm: shelby county chris a myrtue memorial hospital
Also named: Shelby County Chris A. Myrtue Memorial Hospitaldba oflegal entity
Myrtue Medical Centerdba oftrade name
Industry: Healthcarellm

Discovered: Jun 13, 2025
Materiality determined: —
Notification sent: Jul 21, 2025
Affected individuals: 50state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1119 Automated Collection
Threat actor: External
Regulator citations: Submitted initial incident notice on July 21, 2025Submitted supplemental update letter on September 30, 2025

During the incident: Engaged a specialized cybersecurity firm to conduct a forensic investigation
Disconnected all remote access to its network
Changed administrative credentials
Enhanced the security measures
Informed our law firm
Began identifying the potentially affected individuals in preparation for notice
Offered 12 months of complimentary credit monitoring and identity theft restoration services through TransUnion
Changes made: Enhanced the security measures
Took steps and will continue to take steps to mitigate the risk of future harm
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

Nebraska State AGJul 21 · first

Nebraska State AG+71d · this page

Massachusetts State AG+437d

Pattern: first filing Jul 21 (NE), last Oct 1 (MA) — a 437-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/4f9027cd-29c6-40d2-8fc3-1a331669638b.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 30, 2025
Raw hash: a51ad6265f4f7d58dd9f7a84cd72aea67ab1a603ee30d3b54b68169ddccbd6ac

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityShelby County Chris A. Myrtue Memorial Hospital

Incidentdiscovered Jun 13, 2025

Stated responseEngaged a specialized cybersecurity firm to conduct a forensic investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov