2026 KH Credit Union — Kettering Health third-party breach; SSNs and medical billing data (MA AG filing)
Data compromised
Full names, Social Security numbers, bank/financial account numbers, driver's license/state ID numbers, medical billing and claims information, patient account numbers
Technical writeup
KH Credit Union disclosed a data breach affecting member information stored on Kettering Health's network—not on the credit union's own systems. Kettering Health detected suspicious activity on or about May 20, 2025 and determined unauthorized access occurred between April 9, 2025 and May 20, 2025. A review identified KH Credit Union member data residing on Kettering's network. Kettering notified members on behalf of KH Credit Union; Massachusetts Office of Consumer Affairs and Business Regulation received a filing June 16, 2026 (2026-985). Exposed data types include SSNs, financial account numbers, driver's license numbers, and medical billing/claims information. Kettering is offering 12 months of Cyberscout credit monitoring (enrollment deadline September 12, 2026). Total affected count had not been publicly disclosed at catalog time.
Root cause
Unauthorized access to sponsor Kettering Health's network (April 9–May 20, 2025); KH Credit Union member data stored on Kettering systems was potentially viewed or acquired—KH Credit Union's own network was not compromised