Madera Hospital Breach Exposes Data of 150,810 Patients

Madera Community Hospital reported attackers accessed its network for two days in May 2025 and likely exfiltrated files tied to 150,810 individuals. The hospital’s incident notice says exposed information may include names, contact details, dates of birth, Social Security numbers, account credentials, financial account information, treatment and insurance records, and limited biometric data.

The not-for-profit community hospital serves Madera County and nearby areas and provides emergency, surgical, acute care, diagnostic imaging and other medical services. Hospital officials discovered unauthorized activity in May 2025 and hired outside cybersecurity experts and a data-review firm to identify files that might have been taken.

The hospital received the data-review results in April 2026 and began sending breach notices to potentially affected individuals in mid-July 2026. The organization notified the U.S. Department of Health and Human Services. The notice states that not every person had all categories of data exposed and that investigators have not found evidence the information was publicly released.

The extortion group behind the attack issued a ransom demand and later withdrew it, stating it did not want to harm patients. The hospital engaged law enforcement and reported steps to secure its systems but did not provide details on how the attackers gained access or which specific systems were targeted.

The incident notice reads: “We worked with third-party experts to address this event, perform an investigation into the unauthorized activity, and further secure our systems to protect information. We also notified law enforcement.” The notice adds the hospital has been working to confirm accurate contact details for people who may be affected.