Pit River Health Service Data Breach (1.8 Thousand People Affected)

The Pit River Health Service data breach affected at least 1,800 people, according to HHS, in a cybersecurity incident disclosed in late 2025.

Pit River Health Service is a nonprofit California healthcare organization providing medical, dental, and behavioral health services.

What Happened in the Pit River Health Service Breach?

On December 1, 2025, the organization said it had recently experienced a cybersecurity incident and that its electronic health record and Dentrix systems were temporarily unavailable. At that time, it said there was no evidence that patient or billing information had been accessed or compromised.

A December 17 update said the investigation determined that some information had been copied and taken. The organization restored systems in stages while working with cybersecurity specialists and federal agencies. Public notices do not give the exact start date, initial access method, or identity of the responsible actor.

What Information May Have Been Affected?

The HHS entry reports a breach of protected health information, but the organization has not published a detailed list of the copied data fields. Names, Social Security numbers, insurance details, diagnoses, and other specific fields therefore should not be treated as confirmed.

Pit River Health Service said the medical record system operated by the Indian Health Service was not accessed and that no information was altered or deleted. Those statements do not negate the finding that some information may have been copied from other systems.

How Many People Were Affected?

The U.S. Department of Health and Human Services breach portal reports 1,800 affected individuals in an entry dated January 6, 2026. Because the organization was still assessing the scope and individual notice requirements, this figure is treated as a confirmed lower bound.

What Should Affected People Do?

Notice recipients should rely on the data scope in their own letters and review benefit statements, patient portal activity, and insurance records for unfamiliar services, providers, or charges.

Unexpected links, documents, or requests using the Pit River Health Service name should be verified through an official contact channel. Additional measures such as credit freezes or password changes should be selected according to the data actually identified in the person's notice.