October 14, 2026: NorthShore Health Centers, a provider serving Porter, Lake, La Porte and Jasper counties in Northwest Indiana, posted a notice that an unauthorised party had access to parts of its IT environment on August 10–11, 2026. Patient files may have been viewed or taken. The number of people affected has not been published. Canonical record: northshore-health-centers-insomnia2026. Coverage of the notice: HIPAA Journal.
This is a thin-sourcing post. The notice is the company’s own statement, but we did not retrieve the notice text directly, so the details below rely on HIPAA Journal’s account. The number of patients and the data types are still being assessed, and the post says so where it matters.
What happened
- August 10, 2026: NorthShore detected the incident.
- August 10–11: According to the notice, an unauthorised party had access to parts of the IT environment during those two days.
- September 7: A ransomware-tracking site logged a claim by the Insomnia group, which listed NorthShore on its leak site.
- October 14: NorthShore published its website notice. It says patient files may have been viewed or taken.
- October 27: HIPAA Journal reported the notice.
What is known about the method
The notice does not describe how the intruder got in. That is the main gap: without an entry route, readers cannot tell whether the exposure was limited to the two days or whether the access ran longer. The notice also does not say which systems were involved beyond the parts of the IT environment it names.
Why the gap between August and October matters
The notice came about nine weeks after the access it describes, and the extortion group listed NorthShore on its leak site in early September, before the provider published anything. For patients, that means the exposure may have been known to the attacker well before the notice arrived. The notice describes data types as still being assessed, so no count is available yet. Until NorthShore publishes one, any patient whose records sat in the affected systems may be included.
Who may be in scope
HIPAA Journal reports that NorthShore serves patients in Porter, Lake, La Porte and Jasper counties in Northwest Indiana. The notice does not say whether patients elsewhere were in the affected systems. If you have been a NorthShore patient, treat yourself as potentially affected until the provider says otherwise.
Verified vs unverified
- Verified (NorthShore notice, as reported): the detection date of August 10; access to parts of the IT environment on August 10–11; patient files may have been viewed or taken; the data types likely involved are names, Social Security numbers, information about medical treatment and conditions, and health insurance information, still being assessed.
- Not published: the number of people affected.
- Unverified (group claim): the Insomnia data-theft and extortion group claimed the attack on its leak site, and HIPAA Journal reports that the group later released data. We have not verified the leaked files, and NorthShore has not confirmed the claim.
Who is affected
Patients of NorthShore whose files were in the affected systems are at risk. Because the data types likely include Social Security numbers and medical information, the main concerns are identity theft, medical identity fraud and insurance fraud. Patients who see a claim for care they did not receive are the first sign that a record has been misused.
What to do
- Watch for a letter from NorthShore. If one arrives, read it and follow its instructions. Use a phone number from the letter itself.
- Consider a credit freeze with Equifax, Experian and TransUnion. It is free and stops new accounts being opened in your name.
- Check your insurance statements for care you did not receive, and call your insurer if one appears.
- Be wary of calls or messages claiming to be from NorthShore, an insurer or a government agency that ask for your Social Security number, a password or a payment. Hang up and call the number on your own records.
- If you use a patient portal, change the password and turn on two-factor authentication if the portal offers it.
- Keep your records. If you receive a notice, save it, and keep a copy of any claims or messages you receive afterwards.
Context
Insomnia is a data-theft and extortion group that emerged in October 2025 and targets healthcare organisations in the United States, according to threat-intelligence profiles. Extortion groups often publish data when a ransom is not paid, so patients should assume that files may circulate even when the provider has not confirmed publication.
Medical identity theft means someone uses a patient’s name and insurance to receive care. The first sign is usually a bill or an explanation-of-benefits statement for a visit that never happened, so those statements are worth reading line by line for the next several months.
Sources
Related reading
- Moldova’s CNAM health-insurance cyberattack: another health-data incident where insurance records were at stake.