J. Arthur Trudeau Memorial Center 2026 Data Breach

Trudeau Center received alerts about suspicious activity in its computer network on January 29, secured its systems, and began an investigation with specialists. The review determined that files containing personally identifiable information (PII) and protected health information (PHI) had been taken from the network between January 22 and January 28. The organization completed its work to identify the files' contents and the people to whom the information belonged on May 15; the public notice was published on July 15.

The organization says it reported the event to federal law enforcement and reviewed its security controls, policies, and procedures. The notice does not identify the actor, initial access method, tools used, or volume of files taken. Those details should not be added to the verified incident scope.

The information varied by person. The official list includes names with demographic information; physical addresses, dates of birth, and Social Security numbers; clinical information such as provider names, diagnoses, and treatment notes; and financial or health-plan fields such as billing codes, health-insurance information, and Medicare or Medicaid identification numbers.

The notice does not list email addresses, phone numbers, passwords, bank accounts, or payment cards as affected data. Documents mentioned in the consumer letter's general identity-protection instructions should not be interpreted as exposed fields either. It should not be assumed that every confirmed data type was present for all 5,630 people.

The live HHS export identifies J. Arthur Trudeau Memorial Center as a Rhode Island healthcare provider and classifies the event as a hacking/IT incident involving a network server. Its March 30, 2026 submission date and 5,630 affected-person value are regulatory reporting measures distinct from the incident timeline in the public notice.

The 5,630 value is not a file-row, online-account, or unique-email count. It also does not represent records imported into production. It is therefore not displayed as a local total-record count and is presented only as people reported to HHS.

The organization says that, as of the July 15 notice, it had no evidence that PII or PHI had been misused for fraud or identity theft. The Massachusetts consumer letter confirms that affected people were offered 24 months of identity monitoring, fraud consultation, and identity-theft restoration at no cost.

People who received a notice can review health-insurance explanations of benefits, billing records, and Medicare or Medicaid activity alongside credit reports and account statements for services they do not recognize. Social Security or health-plan numbers should not be supplied in response to an unexpected message or call; support and enrollment should begin through the channels in the official notice.