2026 Aitkin County HHS — email phishing breach; 83,114 individuals (Apr)
Data compromised
Per HIPAA Journal and HHS OCR: names, addresses, dates of birth, SSNs, dates/locations of service, case IDs, PMI numbers, medical/health information, diagnoses/treatment, provider names, medications, health insurance IDs, MnCHOICES form metadata, and claims/service data
Technical writeup
Verified healthcare data breach — disclosed June–July 2026. Aitkin County Health and Human Services (HHS), a Minnesota county health and human services agency, discovered April 8, 2026 that an email account was sending phishing messages. Forensic specialists determined unauthorized access to three employee email accounts between April 7 and April 8, 2026, and confirmed contents of one account were downloaded. Review found protected health information for 83,114 individuals in the accounts. The U.S. HHS Office for Civil Rights breach portal lists Aitkin County Health and Human Services with 83,114 individuals affected, submitted June 17, 2026, as a hacking/IT incident involving email with a business associate present. Aitkin County HHS reported password resets, employee phishing training, and email-retention policy changes.
Root cause
Phishing emails sent from compromised Aitkin County Health and Human Services email account April 8, 2026; unauthorized access to three employee email accounts April 7–8 with one account's contents downloaded