Mon General Hospital phishing breach: what patients should know

On 6 May 2026, Monongalia County General Hospital (Mon General) discovered that a phishing attack had reached a small number of staff email accounts. An unauthorized person got into those inboxes the same day. The hospital says that access was cut off that same day. A later investigation, finished in late June 2026 with help from a forensic security firm, found that no other hospital systems or data stores were involved.

The hospital issued a public notice on or about 31 July 2026 and reported the incident to the U.S. Department of Health and Human Services. That official listing names 2,173 people. Depending on the person, the emails could have held first and last names, dates of birth, email addresses, phone numbers, Social Security numbers, health information, and health insurance information. The hospital is mailing letters to people it believes may be affected and is offering two years of credit monitoring. A dedicated helpline is at [phone withheld].

Why “it was only email” is the wrong comfort

Coverage of this incident keeps landing on the same points: a handful of inboxes, locked down the same day, nothing else in the hospital was touched. Those things are true. They are also the least useful part of the story if you have ever been a Mon General patient.

Hospital email is not leftover junk. It is where staff already send the things that live in a medical file — a name sitting next to a date of birth, an insurance number, a Social Security number, a note about care. The attacker did not have to break into a records system. Those details were already sitting in the inboxes they opened. For the 2,173 people whose information was in those messages, the practical result is the same as a records breach: someone else may now have the mix of identity details and health details that make financial fraud and medical identity theft possible.

“Access ended the same day” means the attacker was locked out. It does not mean they left empty-handed. Email can be copied in minutes. The hospital cannot pull those copies back. And you will not get a tidy inventory of exactly which of your details were in which message. The hospital says the information may have been accessed and that it varied by person. That uncertainty is the situation, not a temporary gap in the reporting.

If you have never been treated at Mon General or elsewhere in the Mon Health system, this incident is unlikely to involve you. If you have, the letter — not a news story, and not any online “were you in this claimed breach?” checker — is how the hospital is telling people.

What you should actually expect

• If the hospital believes your information was in those emails, a letter should arrive in the mail. That letter is the notice. There is no public list of names, and no reliable way for an outsider to confirm whether you are one of the 2,173.
• The letter should include an offer of two years of credit monitoring. Questions about the notice can go to the hospital’s helpline at [phone withheld].
• Do not expect a line-by-line account of what of yours was seen. The hospital’s own notice says the information varied and that it may have been accessed — not that anyone can prove a specific message was or was not read.
• The problems that follow an incident like this show up slowly: a credit account you did not open, a tax filing you did not make, or a medical bill or insurance claim for care you never received. Those are the near-term things to watch, not a sudden lockout of your hospital portal.

What you can and cannot fix

If your name, date of birth, Social Security number, phone number, email address, health information, or insurance details were in those inboxes, that copy is out. It cannot be recalled, deleted from the attacker’s hands, or guaranteed unused. No company can undo that.

• If the letter arrives, enroll in the two years of credit monitoring the hospital is offering. It is the one concrete benefit attached to this incident. Use it.
• Place a credit freeze with the three credit bureaus. A freeze is stronger than monitoring: it blocks new accounts in your name. That matters here because Social Security numbers were among the details that may have been in those emails.
• Read your health-insurance statements and Explanations of Benefits. Medical identity theft — someone using your coverage to get care — does not show up on a credit report the way a new credit card does. A claim for a visit or procedure you never had is the warning sign.
• Shrink what people-search sites publish about you. A bare leaked record becomes dangerous when it is joined to listings that add relatives, old addresses, phone numbers, and employers. Those listings, unlike the stolen emails, can actually be removed. That is the lever you still have.