Ransomware attack exposes personal and health data at Sedgebrook senior living community

Sedgebrook, a retirement village and skilled nursing facility in Lincolnshire, Illinois, has disclosed a ransomware attack that resulted in unauthorized access to personal and protected health information belonging to residents and others associated with the facility.

The cybersecurity incident was discovered on May 5, 2025, after network disruptions signaled potential compromise. A subsequent forensic investigation determined that a ransomware group gained access to Sedgebrook’s network between May 4 and May 5, encrypting files and potentially removing data during that period.

An extensive review of the affected files concluded on August 26, 2025, confirming that certain documents contained sensitive information. The data included names, addresses, birth dates, Social Security numbers, driver’s license numbers, financial account details, medical treatment records, medical record numbers, and health insurance information.

Notification letters were mailed to impacted individuals beginning October 24, 2025. Sedgebrook stated that there is no evidence indicating that any of the exposed information has been misused. However, individuals whose Social Security or driver’s license numbers were affected are being offered complimentary credit monitoring and identity theft protection services.

The facility has implemented additional cybersecurity measures to strengthen its defenses and reduce the likelihood of similar incidents in the future. The U.S. Department of Health and Human Services Office for Civil Rights has not yet listed the breach on its public data breach portal, leaving the total number of affected individuals undetermined.

Sedgebrook OpCo SL VII LLC, which operates the senior living community, said it also notified law enforcement and continues to cooperate with authorities. Attorneys working with ClassAction.org are reviewing the incident to determine whether a class action lawsuit may be filed on behalf of those affected. Individuals who have received a notice confirming their inclusion in the breach are being asked to come forward as part of the investigation.