Sturdy Memorial Hospital sturdymemorial.org

Sturdy Memorial Hospital data breach: what happened and what to do

Sturdy Memorial Hospital in Attleboro, Massachusetts reported a ransomware attack that began on February 9, 2021. It compromised the health information of 57,379 people, including Social Security numbers and driver's license numbers.

View all 13,177 breaches

Breach date: 9 Feb 2021
Affected: 57,379
Data exposed: Names, Dates of birth, Social security numbers, Physical addresses, Driver's licenses, Medications, Diagnoses, Financial information, Treatment information
Last updated: 28 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

Sturdy Memorial Hospital in Attleboro, Massachusetts says attackers got into its systems on the morning of February 9, 2021 and took files, including patient files. The hospital secured its systems the same day. According to reporting on the notice, it paid a ransom to get assurances that the stolen information would not be distributed and had been destroyed, and said it was not aware of any of the data being published.

The hospital finished its review on April 21, 2021 and began notifying people on May 28, 2021. It reported the incident to the U.S. Department of Health and Human Services as a ransomware attack affecting 57,379 people. Other filings gave lower counts for individual states, so use HHS's figure as the total.

Sources checked: ocrportal.hhs.gov, hipaajournal.com, databreaches.net

Last verified against the official page: 28 Oct 2026

How we research this Report an error

What was exposed

HHS lists names, dates of birth, Social Security numbers, addresses, driver's license numbers, medications prescribed, diagnoses, and financial and other treatment information. A Social Security number plus a driver's license number and date of birth is enough to apply for credit or a phone contract as someone else. Medication and diagnosis details give scammers material for convincing calls and letters.

The company's response

The hospital notified HHS, the people affected and the media, posted substitute notice and added administrative and technical safeguards.

What this means for you

If your Social Security number was involved, a credit freeze is the single most useful step, and it's free.

What to do if you were in it

1

Freeze your credit at all three bureaus

A freeze is free and stops lenders from seeing your credit report, which blocks most new accounts opened in your name. You place it separately at Equifax, Experian and TransUnion, per the FTC.
2

Check your credit reports

Look for accounts you don't recognize at annualcreditreport.com, the free site for your reports.
3

Read your insurance statements

Compare explanation of benefits statements with care you actually received, and report mismatches to your insurer.
4

Be skeptical of calls about your treatment

Don't give details to anyone who phones you about a bill or a prescription. Hang up and call the number on your card or statement.
5

Report misuse

If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
6

Check whether your email or phone is in this and other breaches

Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up, so you know when to repeat these steps.