Cottage Hospital 2025 Data Breach (37.8 Thousand People Affected)

The 2025 Cottage Hospital data breach was a cyber incident in which an unauthorized party accessed the computer network of the Woodsville, New Hampshire hospital and took files. According to the official notice, access occurred between October 14 and October 21, 2025.

The U.S. Department of Health and Human Services Office for Civil Rights recorded the event as a hacking/information-technology incident involving a network server and reported 37,796 affected individuals.

Verified Incident Timeline

Cottage Hospital learned on December 8, 2025, that an unauthorized party had accessed its network and taken files. The organization began an investigation with outside specialists and determined that the access was limited to one file server. Consumer notices are dated February 6, 2026.

What Information May Have Been Affected?

The scope may vary by person and by their relationship with the hospital. The official sample letter lists names, Social Security numbers, and driver's-license numbers. Bank-account information may also have been involved for people who provided it for direct deposit, while current or former patients may also have had medical or health-insurance information affected.

How the Organization Responded

The hospital says it investigated with outside specialists, will continue to implement and evaluate enhanced safeguards and security measures to protect its systems, and will continue to provide security training to employees.

What Should Affected People Do?

Notice recipients should monitor financial-account activity, credit reports, and health-insurance explanation-of-benefits statements for an unfamiliar transaction or service. People whose Social Security, driver's-license, or bank-account information was affected may consider a free fraud alert or credit freeze based on their circumstances.