On May 6, 2026, Grafton City Hospital discovered a data breach stemming from a phishing attack that compromised several employee email accounts. The hospital terminated unauthorized access on the same day and launched an investigation with a forensic security provider. The investigation concluded in late June 2026, confirming no other systems were impacted, and the breach was reported to the U.S. Department of Health and Human Services on August 22, 2026. Consumers were notified starting September 14, 2026.
The incident affected 1,215 individuals in the United States, specifically in West Virginia, where the hospital is located. Exposed data included first and last names, dates of birth, email addresses, phone numbers, Social Security numbers, health information, and health insurance information. The hospital is a non-profit organization serving Taylor County.
At present, law firm Shamis & Gentile P.A. is investigating the incident for a potential class action lawsuit. Details regarding the full impact on affected individuals may continue to emerge as investigations proceed. Individuals were offered credit monitoring services.