Kootenai Health 2024 Data Breach

Kootenai Health detected unusual activity on March 2, 2024 that disrupted access to certain information-technology systems, secured the environment, and began an investigation with outside cybersecurity specialists. The investigation found that an unknown person may have accessed certain network data around February 22. A review to identify the affected information and current mailing addresses was completed August 1, and the organization mailed notices August 12.

The official notice includes Kootenai Clinic, Kootenai Outpatient Surgery, and Kootenai Outpatient Imaging within the scope. The organization said it notified the FBI, implemented additional security measures, experienced no impact to its ability to serve patients, and was unaware of attempted misuse as of August 12. The last statement describes only what was known when the notice was issued.

The Kootenai Health row in HHS/OCR's live CSV export confirms 464,088 individuals, an April 24, 2024 submission date, “Hacking/IT Incident” as the breach type, and “Network Server” as the location. These are official federal-listing values. Resident subsets in state notifications are within the national total and are not added again.

There is no local import job or person association in the email, username, password, sensitive-data, or general breach-data collections for this entry. The 464,088 figure is therefore the affected-person total reported to HHS, not a local record count.

The person-variable classes are names, dates of birth, Social security numbers, driver's-license or other government-issued identification numbers, medical record numbers, medical treatment and condition information, medical diagnoses, medication information, and health insurance information. The official text uses a “may have been involved” boundary; it does not say files were conclusively removed, every field applied to every person, or a specific account or vulnerability provided initial access.

Recipients whose identity fields were involved can review credit reports, new accounts, and address changes. Those whose health or insurance fields were involved can inspect medical records, patient-portal activity, unfamiliar treatments or medications, bills, and explanations of benefits. The organization offered IDX identity-protection services; the November 7, 2024 enrollment deadline in the Massachusetts sample letter has passed. Current assistance or eligibility should be requested through a channel verified from kh.org.

The incident page is no longer published on Kootenai Health's current site, so the sources use a web archive of the official August 12, 2024 notice; the main kh.org domain remains active. An unexpected message using the Kootenai Health or IDX name should not be trusted merely because it contains accurate personal fields, and recipients should not provide a full Social Security number, password, payment, or one-time code.