Over 80,000 individuals impacted in Minnesota Epilepsy Group cyber incident

Minnesota Epilepsy Group said it suffered a significant data security incident earlier this year that compromised the sensitive personal information of more than  80,000 individuals.

 

Headquartered in Roseville, Minnesota, the Minnesota Epilepsy Group is one of the largest and most comprehensive epilepsy care providers in the Upper Midwest, specialising in the diagnosis, treatment, and management of epilepsy and seizure-related disorders for patients of all ages.

 

In a data security incident notice posted on its website, MEG said that on April 7, 2026, it  identified unauthorised access to its internal network that disrupted its daily operations. 

 

The healthcare provider immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident. It also took steps to secure the affected systems and notified relevant law enforcement authorities about the incident.

 

“The forensic investigation determined that an unauthorised third party accessed Minnesota Epilepsy Group’s computer network at times between March 16, 2026, and April 10, 2026, and may have accessed and acquired certain Minnesota Epilepsy Group files during the incident,” MEG said.

 

The compromised data included names, addresses, dates of birth, Social Security numbers, medical treatment information, and health insurance information. MEG reported the incident to the U.S. Department of Health and Human Services Office for Civil Rights, stating that it identified at least 80,061 individuals who were impacted by the incident.

 

While the healthcare provider found no evidence of the compromised information being misused, it advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general.

 

It has also offered complimentary identity protection and credit monitoring services to  individuals whose Social Security Numbers were compromised during the incident.

 

At the time of publishing, no known hacker group claimed responsibility for the cyber attack on MEG. The healthcare provider also did not share details on who was behind the attack, how much data was compromised, or whether it had received a ransom demand.