Marshfield Clinic Data Breach

Marshfield Clinic opened an investigation after detecting unusual activity in some employee email accounts. The review determined that the accounts were accessed without authorization between August 26 and August 27.

Public statements do not disclose how the accounts were compromised or whether a vulnerability was exploited. The incident is therefore not attributed to an unconfirmed attack method or threat actor.

The categories varied by person. The organization's statement lists names, addresses, phone numbers, dates of birth, insurance identification numbers, medical-record numbers, dates of service, treatment or diagnosis information, laboratory results, and medication information.

Not every category applied to every person. Public sources are not consistent about Social Security numbers, and that field is not confirmed in the organization statement; it is therefore excluded from the catalog's data classes.

The current HHS OCR entry reports 35,952 affected individuals for the email incident involving Marshfield Clinic Health System. The federal entry was submitted on November 7, 2025.

Medical-record numbers, diagnoses, medications, and insurance identifiers can increase the risk of targeted healthcare fraud or medical-identity misuse. Addresses, phone numbers, and dates of birth can make a message imitating a real patient communication appear more credible.

Marshfield Clinic said it conducted a comprehensive review to identify affected information and would notify appropriate individuals by letter. The organization also offered complimentary identity-monitoring services to affected people.

Notice recipients can monitor health-insurance statements, medical bills, and patient-portal activity for unfamiliar transactions. For an unexpected message claiming to come from Marshfield Clinic or an insurer, use contact details from the organization's official website rather than a link supplied in the message.