Midwest Spine and Brain Institute Data Breach

Midwest Spine and Brain Institute, a healthcare provider based in Stillwater, Minnesota, recently notified patients that a cybersecurity incident affecting one of its third-party vendors resulted in unauthorized access to their personal and protected health information. Healthcare providers that maintain sensitive patient records, whether directly or through third-party vendors, have a responsibility to safeguard that information and to notify affected individuals when it is compromised.

Midwest Spine and Brain Institute’s Data Breach Investigation

According to the notification letter Midwest Spine and Brain Institute sent to affected patients, the organization learned that an unauthorized actor had gained access to the network environment of one of its third-party vendors. Upon learning of the issue, Midwest Spine and Brain Institute immediately consulted with the vendor to help ensure the threat was contained and the environment secured, then commenced a thorough investigation with the assistance of external cybersecurity professionals. After an extensive forensic investigation and a complex manual document review, the organization determined on June 18, 2026, that systems accessed on or about November 21, 2024, contained patients’ personal information and/or protected health information.

Healthcare organizations and their vendors are frequent targets of cyberattacks because of the volume and sensitivity of the medical and personal records they maintain, including diagnosis and treatment information that cannot simply be replaced the way a credit card number can. When protected health information is exposed alongside a patient’s name, affected individuals face risks that extend beyond conventional identity theft, including medical identity theft, in which a bad actor uses stolen information to fraudulently obtain medical services or prescriptions in the victim’s name.

The extended timeline between the November 2024 access and the June 2026 conclusion of the investigation illustrates how vendor-related incidents can take considerably longer to resolve than breaches occurring on a company’s own systems, since notification and investigation typically depend on cooperation between the affected organization and the third-party vendor whose environment was compromised.

When Did This Breach Occur?

Midwest Spine and Brain Institute determined that the impacted systems were accessed on or about November 21, 2024. The organization’s forensic investigation and document review concluded on June 18, 2026.

What Information Was Breached?

Midwest Spine and Brain Institute confirmed that affected patients’ full names, along with personal information and/or protected health information, were involved in this incident. The notification letter did not specify a universal list of data elements for every affected individual.

What You Can Do

Midwest Spine and Brain Institute is offering affected individuals complimentary access to Single Bureau Credit Monitoring, Credit Report, and Credit Score services at no charge for 12 months. Consider taking the following steps to protect yourself:

• Enroll in the complimentary credit monitoring services referenced in your notification letter within 90 days of the letter’s date.
• Place a fraud alert or security freeze on your credit files with Equifax, Experian, and TransUnion.
• Review your explanation of benefits statements from your health insurer for services you don’t recognize.
• Request a free copy of your credit report at annualcreditreport.com and review it for unfamiliar accounts.
• Remain alert to phishing emails, calls, or texts referencing this incident.

File a Data Breach Lawsuit Against Midwest Spine and Brain Institute

If you received a notice that your personal or health information was involved in the Midwest Spine and Brain Institute data breach, you may have legal options available to you. Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.