Almeida Law Group is investigating a data breach at Iroquois Memorial Hospital. The breach occurred on October 8th, 2025 – November 15th, 2025 and was discovered on August 28th, 2026. If you were affected, contact Almeida Law Group.
About Iroquois Memorial Hospital
Iroquois Memorial Hospital (IMH) is a 25-bed not-for-profit community acute care hospital located at 200 East Fairman Avenue in Watseka, Illinois. Founded in 1916, it serves more than 50,000 patients annually across east-central Illinois and west-central Indiana. The hospital operates rural health clinics in Watseka, Gilman, and Milford, Illinois, and Kentland, Indiana, along with an attached 35-bed skilled nursing facility. Its services include a 24-hour emergency department, ICU, surgical suites, home health and hospice, outpatient rehabilitation, and paramedic ambulance services. Because the hospital provides direct patient care and stores clinical, financial, and identifying records, the data involved in this incident is particularly sensitive.
What Happened?
Iroquois Memorial Hospital was listed in a Texas Attorney General data security breach report (record BR-0005425). According to that filing, a network intrusion at IMH took place between October 8th, 2025 and November 15th, 2025. IMH’s own breach notification letter, filed with the Massachusetts Attorney General, states that suspicious activity was discovered in the hospital’s computer network on November 10th, 2025. After a prolonged forensic investigation, IMH determined on August 28th, 2026 — nearly ten months after the breach ended — that the affected files contained personal information. A total of 217,703 individuals were affected. Notification was sent by U.S. Mail. The data involved included names, addresses, Social Security numbers, driver’s license numbers, government-issued ID numbers, financial account information, medical information, health insurance information, and dates of birth. IMH offered affected individuals enrollment in Epiq Privacy Solutions ID 3B credit-monitoring services.
The PEAR ransomware group claimed responsibility for an attack on IMH, posting about it on a dark web leak site on December 11th, 2025, and alleging exfiltration of approximately 3.5 TB of data. These are attacker-side allegations from a leak site and have not been confirmed by IMH or any regulator. IMH also separately reported an earlier breach to the U.S. Department of Health and Human Services on January 9th, 2026, which initially identified 621 affected individuals — a figure that expanded dramatically to 217,703 as the forensic investigation continued. Additionally, IMH’s third-party data servicer, Aesto Health, experienced its own network security incident on its Amazon Web Services infrastructure between December 2nd and December 18th, 2025, which may have also exposed IMH patient information; that incident is separate from the direct network intrusion described in the Texas AG filing. Multiple law firms — including Shamis & Gentile P.A., Ahdoot & Wolfson, Dapeer Law P.A., and Srourian Law Firm — have announced class action investigations, though no complaint has been filed as of available reporting.
Key Facts at a Glance
- Company or Organization: Iroquois Memorial Hospital
- Industry: Healthcare – Medical Provider (community acute care hospital)
- Location: Watseka, Illinois 60970
- Incident type: Network intrusion / unauthorized access
- Date of breach: October 8th, 2025 – November 15th, 2025
- Date breach discovered: August 28th, 2026
- Date of consumer notification: October 16th, 2026
- Total persons affected: 217,703
- Identity theft protection offered: Epiq Privacy Solutions ID 3B credit-monitoring services
- Prior breach: Yes — separate Aesto Health third-party breach (December 2nd–18th, 2025) and an earlier HHS disclosure dated January 9th, 2026
- Litigation status: No class action filed; investigations announced by Shamis & Gentile P.A., Ahdoot & Wolfson, Dapeer Law P.A., and Srourian Law Firm
- Source: Texas Attorney General data security breach report (BR-0005425); IMH Breach Notification Letter (Massachusetts AG, doc 2026-1785); BeyondMachines – IMH Ransomware Attack Report; Aesto/IMH Breach Notification Letter (Massachusetts AG, doc 2026-1438)
What Should You Do?
If you received a notice from Iroquois Memorial Hospital, enroll in the Epiq Privacy Solutions ID 3B credit-monitoring services offered before any enrollment deadline stated in your notice. Whether or not you enroll in that program, consider placing a fraud alert or credit freeze with all three major credit bureaus — Equifax, Experian, and TransUnion — to prevent new accounts from being opened in your name. Review your credit reports for free at AnnualCreditReport.com and monitor your bank and financial accounts for any suspicious activity. Because medical information and health insurance information were involved in this breach, also review your Explanation of Benefits statements from your health insurer and request copies of your medical records to check for services you did not receive. Report any suspected identity theft or fraud to the Federal Trade Commission at IdentityTheft.gov.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
