Aitkin County Health Agency Discloses Cyber Incident Affecting Thousands

More than 80,000 people had their sensitive personal information compromised following a recently reported data security incident at Aitkin County Health & Human Services.

 

Aitkin County Health and Human Services is the local government department that provides social services, public health programs, and community assistance for residents of Aitkin County, Minnesota.

 

In a data security incident notice published on its website, Aitkin County HHS said that on April 8, it identified that a county HHS employee’s email account had been compromised and was sending phishing emails. The government department immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

It also took steps to secure the affected systems and notified relevant law enforcement authorities about the incident.

 

“Through the investigation, we determined that there was unauthorised access to a total of three County email accounts between April 7, 2026 and April 8, 2026. During that time, the cyber criminals downloaded the contents of the County HHS email account. 

 

“During the review of the impacted data, we identified one report from the Minnesota Department of Human Services (“DHS”) in the County HHS employee’s email account that appeared to contain MnCHOICES information for individuals associated with the County. On May 13, 2026, we confirmed that the DHS report also inadvertently included viewable information related to the statuses of forms in the MnCHOICES application for individuals not associated with the County, and promptly notified DHS,” Aitkin County HHS said.

 

The compromised data included names, addresses, dates of birth, Social Security numbers, dates and locations of services, case identifying numbers, PMI numbers, medical or health information, healthcare provider names, medications, health insurance identification numbers, information regarding the type and status of forms filed with MnCHOICES, dates form was last modified and more.

 

The incident was reported to the U.S. Department of Health and Human Services, where Aitkin County HHS said it has identified at least 83,114 individuals affected by the incident.

 

The government agency has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general. 

 

At the time of publishing, no known hacker group claimed responsibility for the cyber attack on Aitkin County HHS. The department also did not share details on who was behind the attack, how much data was compromised, or whether it had received a ransom demand.