Heart of America Medical Center, a nonprofit critical access hospital in Rugby, North Dakota, has disclosed a data breach exposing patient Social Security numbers and medical records, roughly fourteen months after it first detected the intrusion. The breach was filed with the Massachusetts Office of Consumer Affairs and Business Regulation on August 5, 2026, according to ClaimDepot, which published the filing details on August 6. The ransomware group Embargo claimed the attack on its dark web leak site on August 6, 2025, asserting it had exfiltrated 800 gigabytes of hospital data. No total victim count has been published, and both available accounts of this incident come from plaintiff-side claim aggregators rather than the hospital, a regulator portal entry, or established security press.
What Happened
The two sources reporting on this incident (S1 and S6, both ClaimDepot properties) agree on the core timeline. Heart of America discovered suspicious activity on its network on or about June 12, 2025. An internal investigation into the scope of that activity concluded on September 15, 2025, confirming that files containing sensitive personal information had been compromised.
On August 6, 2025, roughly eight weeks after the initial detection and more than a month before the hospital's own scope review concluded, the Embargo ransomware group posted a claim on its leak portal naming Heart of America Medical Center. The group stated it had taken 800 GB of data and published sample screenshots as apparent proof.
The gap in this timeline is the story. Detection in June 2025, extortion posting in August 2025, scope determination in September 2025, and regulator notification in August 2026. That is approximately eleven months between the hospital knowing files were compromised and the breach appearing in a state filing. Neither source explains the delay, and the hospital has not publicly addressed it in material available to us.
One caution on the record: S6 describes the hospital as having "experienced a ransomware attack carried out by a group" but the excerpt truncates before naming it. S1 attributes the leak-site claim to Embargo. Neither source indicates whether the hospital itself has confirmed Embargo as the actor, whether encryption occurred alongside exfiltration, or whether a ransom was paid. Treat the Embargo attribution as a leak-site claim corroborated by sample data, not as a victim-confirmed finding.
What Was Taken
Confirmed exposed data types, per the Massachusetts filing as reported:
- Social Security numbers
- Medical records
- Other protected health information and medical information
- Personal and financial information (S1 characterizes the exposure as covering "personal, financial and medical information" but does not itemize the financial elements)
Embargo's own claim puts the volume at 800 GB. That figure is the attacker's, not the hospital's, and attacker-stated volumes are routinely inflated or padded with duplicate and low-value files. It should be read as an upper bound on the claim, not a measured count.
The total number of affected individuals across the United States has not been publicly reported. The Massachusetts filing covers Massachusetts residents only, which for a rural North Dakota critical access hospital is likely a very small subset. The meaningful number will appear on the HHS Office for Civil Rights breach portal, and neither source indicates it has posted there yet.
Heart of America is offering 24 months of complimentary credit monitoring, with an enrollment deadline of 90 days from the date on each notification letter. Twenty-four months is above the twelve-month industry floor, which is a reasonable read on the severity of an SSN-plus-medical-records exposure.
Why It Matters
Critical access hospitals are the softest large targets in American healthcare. Federal designation caps them at 25 inpatient beds and requires them to be geographically remote, which is precisely the profile that produces thin IT staffing and deferred security investment against a full hospital's worth of high-value PHI. Heart of America has served the Rugby area since 1905 and runs satellite clinics in Leeds, Towner, Maddock, and Dunseith, so the affected population plausibly spans most of a multi-county rural catchment where the hospital is the only provider. There is no second hospital for these patients to switch to.
Ransomware crews understand this. The 800 GB claim, if even directionally accurate, represents an institutional data set for a facility of this size, not a targeted subset.
The other pattern worth naming is disclosure latency. Several of the healthcare breaches supplied alongside this incident show the same shape at other organizations: Heart Care Centers of Illinois discovered in January 2026 that an email account had been accessed between August and November 2024, completed its data review on June 11, 2026, and notified patients on July 10, 2026 (HIPAA Journal, and the practice's own Business Wire notice via AP). Ohio Living detected intrusion on April 17, 2026 and still had not determined a victim count when HIPAA Journal reported it. Heart of America Eye Care, a Kansas practice with no corporate relationship to the North Dakota hospital despite the similar name, disclosed an early-April 2026 intrusion to HHS on June 5, 2026 with the data review still open.
Multi-month and multi-year lags between compromise and notification are the norm in this sector, not the exception. Every month of that lag is a month affected patients spend unaware their SSN is in criminal hands.
The Attack Technique
Unknown. Neither source describes an initial access vector, a dwell time, or any technical indicators. There are no IOCs, no CVEs, no named tooling. What is reported is that the hospital detected "suspicious activity on its network," which is consistent with anything from a phished credential to an exposed edge device.
Embargo is a ransomware-as-a-service operation that surfaced in 2024, running the now-standard double extortion model: exfiltrate first, encrypt second, publish samples to a leak portal to force payment. The August 2025 posting with sample screenshots fits that playbook exactly. Reporting on Embargo elsewhere has noted Rust-based payloads and a pattern of targeting healthcare, but nothing in the sources here speaks to what was deployed against this specific hospital, so treat that as general actor background rather than incident detail.
Two adjacent incidents in the supplied material illustrate the vectors that actually dominate this space. HIPAA Journal reports that Heart Care Centers of Illinois traced its exposure to a compromised employee email account accessed for roughly eleven weeks in late 2024, discovered only when the practice investigated a separate, unsuccessful phishing attempt. And Defense One's reporting on the DHS Homeland Security Information Network breach documents the failure mode that turns an intrusion into a disaster: analysts detected the intruders altering files, abusing a legitimate web server binary to execute malicious code, and deleting logs, and twice ruled the activity a false positive. Attackers held the network for roughly three additional weeks before installing backdoors and stealing credential files on June 4, at which point a breach was finally declared.
Neither of those is Heart of America's incident. Both describe how a detectable intrusion becomes an eleven-month notification.
What Organizations Should Do
Audit your detection-to-declaration path, not just your detection rate. The DHS case is the cautionary template: the alerts fired and analysts saw them. What failed was triage. Track how many alerts get dispositioned as false positives without a documented reason, and require a second reviewer before closing any alert involving log deletion, unexpected binary execution, or file modification on production servers.
Alert on log deletion and log gaps as a first-class signal. Anti-forensic behavior is one of the few attacker actions with essentially no benign explanation. Forward logs off-host to append-only storage so deletion on the endpoint does not destroy the evidence.
Monitor ransomware leak sites for your own name and your vendors'. Embargo named this hospital publicly on August 6, 2025, six weeks before the hospital's own scope review concluded. Leak-site monitoring is cheap and frequently tells you about a breach, yours or a supplier's, before your forensics finish.
Instrument for egress volume, not just intrusion. An 800 GB claim implies sustained outbound transfer that volumetric baselining on network egress and cloud storage APIs would surface. Alert on outbound anomalies by host and destination.
Rehearse the notification decision separately from the incident response. Scope determination and patient notification are different workstreams with different clocks. Build the notification timeline into your IR plan with named owners and hard dates, and start the data review the day exfiltration is confirmed rather than after remediation closes.
For small and rural providers specifically, buy detection you do not have to staff. A 25-bed critical access hospital cannot run a 24/7 SOC. Managed detection and response, enforced phishing-resistant MFA on email and remote access, and offline-verified backups deliver most of the achievable risk reduction without headcount you will never get funded.
Sources: Heart of America Data Breach Exposes SSNs and Medical ... | Ohio Living; Erlanger; Heart of America Eye Care Announce Data Brea... | Heart Care Centers of Illinois Discovers Historic Phishing Attack E... | Heart Care Centers of Illinois: Notice of Data Security Incident A... | Heart of America Eye Care Data Breach Reported, Lawsuit Possible | Heart of America Medical Center Data Breach Lawsuit Investigation | Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of... | DHS network intrusion was twice ruled a false positive before breac...