Kalispell Regional Healthcare logan.health

Kalispell Regional Healthcare data breach: what happened and what to do

Phishing emails in 2019 led Kalispell Regional Healthcare (now Logan Health) staff to give up their login details. The US health department lists 149,661 people affected. Names, dates of birth, addresses, Social Security numbers and treatment information were involved.

View all 13,177 breaches

Breach date: 24 May 2019
Made public: 22 Oct 2019
Affected: 149,661
Data exposed: Names, Dates of birth, Physical addresses, Social security numbers, Email addresses, Health insurance information, Medical information, Treatment information
Last updated: 27 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

Kalispell Regional Healthcare, now called Logan Health, is a Montana health system. In 2019 employees received a convincing phishing email and entered their login credentials on a fake page. The system said patient information had been exposed going back to May 24, 2019, and announced the breach in October 2019.

The US Department of Health and Human Services (HHS) lists 149,661 people affected. Early local press reports said about 130,000, and the hospital's spokesperson confirmed 129,641 patients at the time of the first announcement. According to HHS, the information included names, dates of birth, addresses, Social Security numbers, email addresses, claims information, diagnoses, medications prescribed and other treatment information.

The health system notified HHS, affected individuals and the media, and added technical and administrative safeguards. A class action over the breach ended with a $4.2 million settlement fund, according to Govtech.

Medical details plus a Social Security number are a risky mix. They can be used for identity theft, for medical identity theft (using your insurance), and for convincing phishing that quotes real treatment details.

Sources checked: ocrportal.hhs.gov, scworld.com, portswigger.net

Last verified against the official page: 27 Oct 2026

How we research this Report an error

What to do if you were in it

1

Read your notice and check your insurance statements

Look at explanation of benefits statements for care you didn't receive. The FTC advises reviewing these and reporting medical identity theft.
2

Freeze your credit

A Social Security number was exposed. The FTC says a credit freeze is free and blocks most new accounts in your name. Place it at Equifax, Experian and TransUnion.
3

Expect phishing that mentions your care

Messages that cite a doctor, a drug or a claim may be scams. Call the provider or insurer on a number you already trust.
4

Change reused passwords

Email addresses were exposed. Make sure your email account has a unique password and two-factor login.
5

Check whether your email or phone is in this and other breaches

Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data appears, so you know what to act on.

Official filings

U.S. Department of Health and Human Services , filed 22 Oct 2019 : 149,661 people

Timeline

24 May 2019
The breach happened
22 Oct 2019
The company made it public
22 Oct 2019
Reported to U.S. Department of Health and Human Services

Frequently asked

Was I affected by the Kalispell Regional Healthcare breach?

If you were a patient and got a notice letter, yes. HHS lists 149,661 people affected.

What was exposed?

Names, dates of birth, addresses, Social Security numbers, email addresses, claims information, diagnoses, medications and other treatment information, according to HHS.

Is there a settlement?

A class action over the 2019 breach ended with a $4.2 million settlement fund, as reported by Govtech.

Should I change my password?

Passwords weren't listed as exposed, but staff logins were phished. A credit freeze matters more for you.