Northwoods Surgery Center 2025 Data Breach

The primary source is the Notification of Data Security Incident PDF dated November 7, 2025 and published on Northwoods Surgery Center's own website. It directly describes the discovery date, possible access window, investigation with third-party specialists, possible health-data fields in the files, security improvements, and protective services.

The HHS OCR record classifies the organization as a Minnesota healthcare provider and reports 5,385 people, an April 29, 2026 submission date, a network-server location, and a hacking/IT incident type. Claim Depot presents the official timeline and information classes alongside the federal record and supports public verification of the event.

Northwoods learned of unauthorized network activity on or around September 8, 2025 and immediately acted to secure the network and prevent further access. An investigation with third-party specialists found that a limited amount of information may have been accessed by an unauthorized party between July 11 and September 8.

The official notice says analysis was ongoing when published and that possible access to the information could not be ruled out. The source does not state that files were definitively copied or exfiltrated and does not identify the attacker or initial entry method. Unverified person counts, data fields, and threat-actor claims are not treated as part of the public incident scope.

Possible fields include patient names, addresses, dates of birth, health-insurance information, and medical-record numbers. This combination may create risks involving targeted phishing, insurance fraud, and medical-identity impersonation. The official text says files may have contained PHI for a limited number of patients.

The HHS total of 5,385 does not mean every information class applied to every person. Combinations may vary, and the number of files has not been disclosed.

The official list includes a doctor's name, practice type, medical date of service, medication information, diagnosis and treatment information, and medical claims or billing information. These fields may associate a patient with a particular provider, procedure, and care history and are sensitive from a health-privacy perspective.

The notice does not say that the entire electronic health-record system or complete patient files were affected. A practice type and date of service do not establish a specific surgery, detailed clinical note, or imaging result.

Northwoods secured the network, stopped access, and engaged third-party specialists for forensic review. It says it worked with specialists to evaluate and reinforce existing security measures across its network and facilities. At the time of notice, there was no evidence of actual or attempted fraudulent misuse of information.

Potentially affected people were offered credit-monitoring and identity-protection services. A weekday assistance line at 1-833-833-6099 was published for incident information and enrollment support. Because the public notice does not state a service duration, LeakData does not invent a term or provider package.

Patients should review health-insurance explanation-of-benefits statements, medical bills, prescription histories, and patient portals for unknown services or claims. If an unfamiliar doctor, date of service, medication, diagnosis, treatment, or charge appears, the relevant provider and insurer should be notified through a verified channel.

Dates of birth, insurance details, or medical-record numbers should not be shared in unexpected email, text messages, or calls claiming to represent Northwoods; only the assistance line in the official notice should be used. If a suspicious message or account event appears, it should be verified through the organization’s current official contact channel without using links in the message. When an individual notification letter is available, it is the primary source for the person-specific data scope and protection options offered. Dates and data categories should be interpreted only to the extent supported by public sources; undisclosed details should not be treated as confirmed.