Esse Health data breach exposes sensitive personal information of over 260,000 people

St. Louis, Missouri-based Esse Health said the data security incident it suffered earlier this year compromised the sensitive personal data of more than 260,000 individuals.

 

In a data security incident notice, Esse Health said that on April 21, it identified suspicious activity within its internal network. The healthcare provider media launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

It also took steps to contain the incident, secured its affected network and notified relevant law enforcement authorities about the same.

 

“Based on the investigation, a cybercriminal gained access to our network on April 21, 2025. While in our network, the cybercriminal was able to view and copy certain files,” Esse Health said.

 

The compromised data included names, addresses, Social Security numbers, dates of birth, health insurance information, medical record numbers, patient account numbers, and certain health information. Esse Health added that its electronic medical record system was not accessed or copied by the threat actors.

 

In a filing with the Maine state regulator, Esse Health said that it has identified at least 263,601 individuals impacted by the incident.

 

“As part of our ongoing commitment to the privacy and security of information in our care, we have implemented additional security enhancements to further strengthen our defences,” Esse Health added.

 

While the healthcare provider found no evidence of the compromised data being misused, it advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general.

 

It has also offered one year of complimentary identity protection and credit monitoring services through IDX to all affected individuals.

 

At the time of publishing, no known hacker group claimed responsibility for the cyber attack on Esse Health. The hospital also did not share details on who was behind the attack, how much data was compromised, or whether it has received a ransom demand.