Lexington Hospital Corporation, a Tennessee healthcare provider, reported a hacking or IT incident affecting 67,000 individuals to the U.S. Department of Health and Human Services on September 8, 2026. The report lists a network server as the location of the breached information.
Lexington Hospital Corporation’s Data Breach Investigation
Lexington Hospital Corporation is listed on the U.S. Department of Health and Human Services (HHS) Office for Civil Rights breach portal as a healthcare provider located in Tennessee. The portal is the public list of breaches of unsecured protected health information that affect 500 or more people, and entities covered by HIPAA must report to it when such an incident occurs.
According to the portal entry, the breach was submitted on September 8, 2026, and 67,000 individuals were affected. The entry classifies the type of breach as a hacking or IT incident and identifies a network server as the location of the breached information.
The portal entry is short by design. It does not describe how the intruder got in, how long they had access, whether files were copied, or what categories of personal or health information were stored on the affected server. Because those details have not been published in the sources reviewed for this page, this page does not guess at them. The company’s own notice was not located at the time of writing.
A hacking or IT incident involving a network server can matter because servers often hold shared files, scanned documents and databases that support patient registration, billing and clinical work. Whether any such records were involved here has not been disclosed, and readers should not assume that any particular type of information, such as Social Security numbers or medical records, was exposed.
Healthcare organizations are frequent targets because patient records combine identity details with health and insurance information that can be used for fraud. Reports to the HHS portal that involve 500 or more people are also reviewed by the Office for Civil Rights, which can investigate how a covered entity protected the information it held.
Under HIPAA, covered entities generally must notify affected individuals without unreasonable delay, and no later than 60 days after discovering a breach. Notice letters usually explain what happened, what information was involved and what steps the organization is taking, and they often include an offer of credit monitoring or identity protection. If you receive a letter, keep it, along with any activation code or enrollment deadline it lists.
When Did This Breach Occur?
The HHS portal lists a breach submission date of September 8, 2026. The portal entry does not state when the unauthorized access began or when the organization discovered it, so the dates of the underlying events have not been confirmed.
What Information Was Breached?
The HHS portal lists a network server as the location of the breached information and a hacking or IT incident as the type of breach. It does not say which kinds of personal or health information were involved. Lexington Hospital Corporation has not publicly disclosed a specific list of affected data types in the sources reviewed for this page.
What You Can Do
If you received a notice from Lexington Hospital Corporation, consider these steps:
- Read the notice carefully and note any enrollment deadline or activation code for free credit monitoring or identity protection.
- Place a free fraud alert on your credit file, or consider a credit freeze, with Equifax, Experian and TransUnion.
- Review explanation of benefits statements, insurance statements and bank accounts for anything you do not recognize, and check your credit reports for free at annualcreditreport.com.
- Report suspected identity theft to the Federal Trade Commission at identitytheft.gov and to your state Attorney General.
File a Data Breach Lawsuit Against Lexington Hospital Corporation
If you received a notice about this incident, or believe your personal or health information was exposed, you may have legal options. Healthcare organizations are expected to safeguard patient information, and a class action can help hold them accountable when they fail to do so.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
