Mon Health phishing attack: 2,173 patients may have personal data exposed

On May 6, 2026, Monongalia County General Hospital Company — the organization behind Mon Health Medical Center — found that a phishing attack had reached a small number of employee email accounts. An unauthorized person got into some of those mailboxes that same day. The hospital says the access was cut off the same day, and a later investigation, finished in late June, found that no other hospital systems or stored records were touched.

The hospital told the U.S. Department of Health and Human Services on July 31, 2026 that 2,173 people may have been affected. Information in those emails may have included first and last name, date of birth, email address, phone number, Social Security number, health information, and health insurance information. It is mailing letters to people it believes were involved and offering two years of credit monitoring, plus a dedicated helpline.

It was “only email.” That is not the comfort it sounds like.

Every public account of this incident leans on the same points: a small number of accounts, access shut down the same day, no other systems hit. All of that is true. It is also the part that matters least if your information was sitting in one of those inboxes.

The attacker did not need the hospital’s main medical-records system. Staff email is where a name already sits next to a date of birth, a Social Security number, an insurance ID, and notes about care. That mix is enough to open credit, file a tax return in someone else’s name, or bill an insurer for treatment that person never received. No other systems were impacted means the breach was contained. It does not mean the data that left was mild.

It will not have been the same for everyone. The hospital’s own notice says what may have been involved varied from person to person. Some people in those mailboxes may have appeared as little more than a name and a callback number. Others may have been in a thread that held the full set. You will not get a line-item list of exactly which of your details were in which message.

There is also the gap. The intrusion was found on May 6. The investigation wrapped up in late June. The public notice and the federal filing came on July 31. If anything was done with the data in those weeks, the first warning most people will get is a letter — or a bill, or a credit alert — that arrives later.

What to actually expect

• If the hospital believes you were involved, you should get a mailed letter. That letter is how this incident identifies people. It should explain how to enroll in the two years of credit monitoring they are offering and will point you to their helpline.
• The letter will not tell you, with certainty, every field that applied to you. The hospital has already said the information varied. Treat the full list — name, date of birth, contact details, Social Security number, health and insurance information — as possible, not as confirmed for you personally.
• In the coming months, watch for medical bills, insurance explanations of benefits, or pharmacy claims you do not recognize, and for tax or credit activity you did not start. Those are the uses this mix of data actually enables.
• Expect follow-up phishing and phone calls that mention this incident or pretend to be Mon Health, a credit bureau, or the helpline. The hospital has said it is contacting people by mail. It does not need you to click a link or read out a Social Security number over the phone to “verify” you.

What you can and cannot fix

If your Social Security number, date of birth, or health and insurance details were in those mailboxes, that copy is out. It cannot be pulled back. Credit monitoring does not erase it. A letter from the hospital does not erase it. No one can remove the breached file from whoever took it.

• Freeze your credit at the three major bureaus. A freeze is stronger than the monitoring the hospital is offering, and you can still enroll in that monitoring. Name, date of birth, and Social Security number are the usual kit for opening new accounts. A freeze is what actually blocks that.
• Read every insurance explanation of benefits and medical bill as if it might not be yours. this claimed breach included health information and health insurance information. Medical identity theft shows up as claims for visits, tests, or prescriptions you never had. Call the insurer on the statement, not a number from an unexpected email or text.
• Get an IRS Identity Protection PIN before the next tax season and watch for a return you did not file. A Social Security number plus a date of birth is what a false return needs. The PIN is free and stops a second return from being accepted in your name.
• Shrink the public listings that make a leaked record usable. A bare hospital email with your name and Social Security number becomes much more dangerous when a people-search page adds relatives, phone numbers, employers, and previous addresses next to it. Those listings, unlike the stolen emails, can actually be removed. That is the part of your footprint you can still change.