Shelby County Myrtue Medical Center, known as Myrtue Medical Center, has told current and former patients that data was taken from its systems without authorization, and it is offering complimentary credit monitoring and fraud assistance.
Here is what the notice says, what it leaves out, and what you can do if you received one.
Myrtue Medical Center’s Data Breach Investigation
Myrtue Medical Center is a collective of health care centers serving Harlan, Iowa, and nearby communities. The legal name used in the notice is Shelby County Myrtue Medical Center. This page is based on a draft sample notification letter that the medical center filed with the Massachusetts state government, which publishes breach notification letters on a public list, together with the facts stated in that letter.
According to the letter, on or about June 13, 2025, the medical center became aware of suspicious activity within its network environment. It says it took steps to lock down and secure the environment and engaged a specialized third-party cybersecurity firm and IT personnel to help secure its systems and carry out a forensic investigation of the nature and scope of the activity.
The letter says the forensic investigation concluded on July 17, 2025, and confirmed that data had been taken from the medical center’s systems without authorization. The investigation also identified the affected data. The medical center then engaged a separate vendor to data mine that information to work out which types of information were involved and which individuals were potentially affected. That vendor completed its review on June 5, 2026.
After the data-mining review, the medical center says it carried out a detailed internal review of its records to find contact information for the people it needed to notify, and then organized the mailing, call center and credit monitoring services. The date the notification list was finalized is left as a blank placeholder in the filed copy. The letter explains that this process was needed to identify accurately whose personal and protected health information may have been affected.
The medical center says it began notifying potentially affected people earlier, through a notice on its website and a media notice on June 27, 2025, while the investigation was still going on. It also says it has taken additional technical and administrative steps to strengthen the security of its systems. This page repeats these statements as the medical center’s own account and has not independently verified them.
The filed letter is a draft sample, with placeholder text such as sample names and unfilled numbers. It does not state how many people were affected, and the Rhode Island section uses a placeholder where a count of residents would go. This page does not state a count because none has been published in the filing, and it does not rely on figures from unverified third-party websites.
In response, the letter says the medical center is offering access to single bureau credit monitoring, a single bureau credit report and a single bureau credit score at no charge, with alerts sent on the same day a change is made at the bureau. The length of the offer is left blank in the draft. It also says proactive fraud assistance is available, provided by Cyberscout, a TransUnion company. People must enroll within 90 days of the date of their letter, using the activation website and unique code in the letter.
The letter lists a toll-free line for questions, open Monday through Friday, 8 a.m. to 8 p.m. Eastern time, excluding national holidays. It also includes standard consumer protections: how to get a free credit report at annualcreditreport.com, how to place a fraud alert or credit freeze, and state-specific information for residents of several states. If you were a patient and did not receive a letter, calling that line or the medical center is a reasonable first step.
Because the letter says the information involved varies by person, your own notice is the best guide to what applies to you. Health information and Social Security numbers are hard to replace, so it is sensible to watch your credit reports, review explanation of benefits statements for services you did not receive, and be careful with unexpected calls, texts or emails that mention the incident. If you are unsure whether a message is genuine, contact the organization using details from its own website rather than details in the message.
When Did This Breach Occur?
The medical center says it became aware of suspicious activity on or about June 13, 2025, and that its forensic investigation concluded on July 17, 2025.
A data-mining review of the affected data was completed on June 5, 2026. The medical center posted a website and media notice on June 27, 2025.
What Information Was Breached?
The notice lists the following types of information that may have been involved: name, demographic information, Social Security number, government identifiers, health or medical information, account credentials, health insurance information and financial account information.
The notice says the information involved varies for each person, so not everyone’s information included every item.
What You Can Do
If you received a notice related to Myrtue Medical Center or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Enroll in the complimentary credit monitoring within 90 days of the date on your letter, using the activation website and unique code it provides.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Myrtue Medical Center
If your personal information was exposed in this incident, you may have legal options. Organizations are expected to protect the sensitive information they are trusted with, and a class action can help hold them accountable when security falls short.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
