Sturgis Hospital data breach: what happened and what to do

What happened

Sturgis Hospital, a community hospital in Michigan, detected unauthorized activity in part of its computer network in December 2024. While that investigation was still running, it found more unauthorized activity in June 2025. In a notice on its website, the hospital said an unauthorized third party may have accessed or acquired personal and health information of patients and employees. It reported the incident to the U.S. Department of Health and Human Services (HHS) on September 18, 2025, listing up to 77,771 affected people. HHS describes the incident as a ransomware attack.

What was exposed

According to the hospital's notice and news coverage, the files may include names, contact details, a government ID number such as a Social Security number, financial account details such as a bank account number, health insurance information and clinical information.

That mix matters. A Social Security number and a date of birth together are what criminals need to open credit in your name. Bank details can be used for payment fraud. Insurance and clinical details feed medical identity theft and convincing phishing calls that sound like they come from your hospital or insurer.

The hospital's response

The hospital said it worked with outside security experts, investigated the activity, secured its systems and notified law enforcement. Affected people were offered free identity theft protection and credit monitoring.