On or around May 27, 2026, Shoshone Medical Center discovered unauthorized access to an employee email account. The center took action to reset passwords and launched a third-party forensic investigation. By July 29, 2026, the investigation revealed that an unauthorized third party may have accessed personal information stored in the affected account. The breach was reported to the U.S. Department of Health and Human Services on August 25, 2026.
The incident affected 553 people and may have exposed patient names, addresses, dates of birth, medical record numbers or patient identification numbers, Medicare or Medicaid numbers, provider names, health insurance information, admission and discharge dates, diagnosis or treatment information, and treatment cost information. Social Security numbers and direct financial account data were not identified as compromised. The official notice did not publicly specify the number of individuals notified.
Details can continue to emerge as investigations progress, and consumer notification timelines can vary. The full scope of affected states beyond Idaho is not yet clear.