According to a filing with Maine's Attorney General on Monday, the attackers stole a wide range of sensitive data for each impacted patient, including personal information (e.g., name, address, date of birth), health insurance information, medical record number, patient account number, and some health information. While Esse Health has yet to reveal the nature of the attack, restoration efforts spanning multiple months suggest a ransomware attack, where some of its systems were encrypted after the threat actors stole documents containing patients' data. Impacted systems were brought back online until June 2, when Esse Health updated a notification on its website to inform patients they could again reach out via all regular channels, including text messages, phone calls, and the patient portal. Esse Health also provides them with free identity protection services through data breach and recovery services provider IDX if they enroll by September 25, 2025. Esse Health also stated that it found no evidence of stolen social security numbers and confirmed that its NextGen electronic medical record system was not breached. While in our network, the cybercriminal was able to view and copy certain files," Esse Health privacy officer Jaime L. Louis, Missouri, is notifying over 263,000 patients that their personal and health information was stolen in an April cyberattack.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 01 Jul 2025 13:05:15 +0000