Methodist Homes May 2025 Email Data Breach (1.4 Thousand People Affected)

The May 2025 Methodist Homes email data breach involved unauthorized access to an employee email account and the acquisition of personal or health information belonging to certain residents, employees, and prospective employees.

The U.S. Department of Health and Human Services Office for Civil Rights recorded the event as a hacking/information-technology incident involving email and reported 1,406 affected individuals.

Verified Incident Timeline

Methodist Homes discovered unauthorized activity on May 21, 2025. Its investigation found that an unauthorized person accessed the employee account between May 8 and May 21, 2025 and acquired some information in the account. Notices were mailed on January 5, 2026 to people whose addresses could be identified.

What Information May Have Been Affected?

The scope varies by person and relationship to the organization. For residents, names may have appeared with Social Security numbers, dates of birth, Medicare numbers, or medical treatment and condition information. For non-residents, the notice lists names with Social Security numbers, passport numbers, driver's license or state ID numbers, medical-history information, health-insurance information, and online login information.

How the Organization Responded

Methodist Homes says it secured the account, investigated with cybersecurity specialists, and reported the incident to relevant state authorities and the federal health authority. It offered free credit monitoring to people whose Social Security numbers were involved.

What Should Affected People Do?

Recipients should rely on the data types identified in their individual notice. People whose health or Medicare information was involved can review statements and service records, while those with identity information can monitor credit reports. Anyone whose online login information was affected should change the relevant password through the service's official channel and update other accounts where the same password was used.