Anna Jaques Hospital data breach exposes information of over 310,000 patients following ransomware attack

Anna Jaques Hospital, a not-for-profit healthcare provider based in Massachusetts, has disclosed a significant data breach stemming from a ransomware attack nearly a year ago. The incident, which occurred on December 25, 2023, has exposed sensitive information about approximately 316,342 patients, according to an update on the hospital’s website and records filed with the Office of the Maine Attorney General.

The breach came to light during last year’s holiday season when hospital administrators identified suspicious activity impacting their systems. Immediate action was taken to contain the damage, including taking affected systems offline and notifying law enforcement. Despite these efforts, the "Money Message" ransomware group publicly extorted the hospital by leaking data samples on January 19, 2024. It released all stolen information on January 26 after the hospital refused to comply with their demands.

Following the attack, Anna Jaques launched a comprehensive forensic investigation to assess the scope of the breach. Due to the detailed and manual nature of the document review, the investigation was only concluded on November 5, 2024.

The compromised data includes demographic details, medical records, health insurance information, social security numbers, driver’s license numbers, financial information, and other personal or health-related data shared with the hospital.

Anna Jaques has assured the public that, to date, there is no evidence of fraudulent activity linked to the breach. Nonetheless, the hospital has notified all impacted individuals, beginning on December 5, 2024, as part of its mitigation efforts.

To support those affected, Anna Jaques offers 24 months of identity protection and credit monitoring services through Experian. The hospital has also advised patients and employees to remain vigilant, review financial account statements for irregularities, and consider placing fraud alerts or security freezes on their credit files.

As a mid-sized acute care hospital serving the Merrimack Valley, North Shore, and southern New Hampshire, Anna Jaques plays a critical role in its community. It performs over 4,700 surgeries annually with a team of 200 physicians and 1,200 staff members. The breach highlights the growing risks healthcare institutions face as ransomware attacks increasingly target sensitive medical and financial data.