Klickitat Public Hospital District #2, doing business as Skyline Hospital in Washington State, has reported a hacking or IT incident that affected 501 people. The report was submitted to the U.S. Department of Health and Human Services on September 15, 2026.
The public record is thin at this point. This page sets out what the filing says and what has not been disclosed.
Skyline Hospital’s Data Breach Investigation
The details currently available come from the federal breach portal maintained by the HHS Office for Civil Rights. The portal lists healthcare organizations that report breaches of unsecured protected health information. Its entry is filed under the name Klickitat Public Hospital District #2, with the notation that it does business as Skyline Hospital. It identifies the organization as a healthcare provider in Washington and records 501 individuals affected.
The entry classifies the event as a hacking or IT incident. That category covers situations where an outside party gets into a computer system or network without permission. The listing gives a network server as the location of the information involved, and it shows that no business associate was present. That suggests the affected data sat in the hospital district’s own systems rather than with an outside vendor, though the listing does not explain further.
The portal shows a submission date of September 15, 2026. It does not say when the incident began or when it was discovered, and it does not say how long an unauthorized person may have been inside the network. It does not describe how the intrusion happened or whether ransomware was involved. This page does not fill in those gaps with guesses.
Skyline Hospital operates as a public hospital district, which is a local government entity that provides healthcare services to its community. Public hospitals and the districts that run them hold records for large numbers of patients, and those records can cover emergency visits, inpatient stays, clinic appointments, billing, and insurance. This is general background about the type of organization and not a statement about which records were involved here.
The hospital district has not publicly said which kinds of personal information were involved. That is a significant open question, because the level of risk to an individual depends on whether the exposed information was limited to contact details or reached more sensitive items such as Social Security numbers, insurance numbers, or treatment records. No such details are confirmed for this incident.
A federal portal entry is frequently the first public sign of a breach. The notification letter sent to affected individuals can come later and is usually where the organization explains the timeline, the categories of information involved for each person, and any protection it is offering. A notice from the hospital district has not been found in the sources reviewed for this page. If you receive one, it is the best guide to your own situation.
Hospitals are frequent targets for cyberattacks because patient records combine identifying details with insurance and clinical information, and because a hospital cannot afford long outages. Smaller and rural facilities can also have limited security staffing compared with large health systems. These are industry-wide observations and are not findings about Skyline Hospital.
Federal health privacy rules require covered entities to notify affected individuals after a breach and to report larger breaches to the federal government, which is why this incident appears in the portal. Whether an organization acted on time and used reasonable safeguards to protect patient information are the kinds of questions that data breach claims often examine.
For the 501 people counted in the filing, the practical advice mirrors any healthcare breach. Watch the mail for a notice and read it closely. Treat unexpected calls, texts, and emails that mention your care or insurance with suspicion, because scammers sometimes follow a publicly reported breach with messages that appear to come from the affected provider.
People affected by a breach like this may also have legal options. A class action can allow many affected people to bring claims together, which can be a practical route when each person’s individual losses are modest but the exposure of private health information is shared across a group.
When Did This Breach Occur?
The federal filing lists a submission date of September 15, 2026. It does not state when the incident occurred or when it was found, so the dates of the intrusion itself are not known.
If you are notified, the letter should give those dates. Keep it with your records.
What Information Was Breached?
Skyline Hospital has not publicly said which types of information were involved. The filing says the breached information was on a network server but does not list data categories.
As a hospital, the organization holds patient care and billing records, but it is not confirmed that any of that was affected. A notice, if you receive one, is the best source for what applies to you.
What You Can Do
If you may be affected by the incident at Skyline Hospital, consider these steps:
- Watch for a notice by mail or email, and keep it with your records.
- Request your free credit reports from Equifax, Experian, and TransUnion through annualcreditreport.com and look for accounts you do not recognize.
- Consider a free fraud alert or security freeze on your credit file with each of the three credit bureaus.
- Review your health insurance statements and explanations of benefits for services you did not receive.
- Be cautious with unexpected calls, texts, or emails about your care or billing, and do not share personal details with someone who contacts you first.
- Report suspected identity theft to the Federal Trade Commission at IdentityTheft.gov and to your state attorney general.
File a Data Breach Lawsuit Against Skyline Hospital
People whose private health information is exposed in a hacking incident may be able to bring claims against the organization responsible, particularly if reasonable security steps were not taken.
If you were notified that your information was involved in the incident at Skyline Hospital, it may be worth speaking with a lawyer about your options. Keep your notice and records of any fraud, or of the time and money you spent dealing with it.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
