Hospice of Murray County has disclosed a data security incident affecting information stored on its computer server. This page explains what the organization has said, what remains unclear and what patients and families can do now.
The details below come from the organization’s own notice and the federal health breach portal, and they may change as the review continues.
Hospice of Murray County’s Data Breach Investigation
Hospice of Murray County is a free-standing, community-based, non-profit hospice provider based in Slayton, Minnesota. It cares for terminally ill patients in their own homes, in nursing homes and assisted living facilities, and at its hospice residence, and it serves patients across a number of counties in southwest Minnesota. Like any health care provider, it keeps detailed records about the patients it serves and about their families.
In a notice dated October 13, 2026, addressed to patients and family members, Hospice of Murray County said that a data security incident occurred on August 24, 2026 and involved information stored on its computer server. The organization said it began reviewing the situation after the incident to work out what information may have been affected and what steps were needed to protect the privacy of patients and their families. The notice does not describe how the incident happened or who was responsible.
The incident was also reported to the U.S. Department of Health and Human Services Office for Civil Rights, which publishes breaches of unsecured protected health information that affect 500 or more people. The entry for Hospice of Murray County lists the organization as a healthcare provider in Minnesota, lists 800 individuals affected, and gives a submission date of October 13, 2026. It classifies the breach type as a hacking or IT incident, and it lists the locations of the breached information as a desktop computer, an electronic medical record and a network server.
The notice includes a statement that deserves careful reading. Hospice of Murray County said that, at this time, it is not aware of any protected health information that has been compromised as a result of the incident. At the same time, it said the review is ongoing and that it cannot rule out the possibility that personal or sensitive information may have been affected. In practical terms, the organization has not confirmed that records were taken, but it has not ruled it out either, and it chose to notify patients and families and to report the matter to regulators.
That position is common early in a data security review. Forensic work on a server can take time, and organizations are often required to notify people before they can say with certainty which files were opened or copied. Because the review was still under way when the notice went out, the information in it may be updated later, and the number of people affected could change if the review turns up additional records.
Hospice records are especially sensitive. They tie together a person’s identity, their insurance details and detailed information about serious illness and end-of-life care. When records like these are exposed, the concern is not limited to the patient. Family members who appear in the files as contacts, guarantors or next of kin can also be affected, which is why the organization addressed its notice to both patients and family members.
Health care organizations of every size are frequent targets for cyberattacks because their records are valuable and their systems are hard to take offline. Smaller providers in particular often run on a limited number of servers and desktop computers, so a problem in one place can reach the electronic medical record and the files stored alongside it. That context applies to the sector in general and is not a statement about the specific cause of this incident, which Hospice of Murray County has not described.
Federal rules require covered health care providers to notify affected individuals without unreasonable delay after discovering a breach of unsecured protected health information, and to notify the federal government when 500 or more people are affected. State laws add their own notification requirements. Anyone who receives a notice should keep it, since it is the clearest record of what the organization says was involved and what it is doing about it.
Attorneys are looking into the incident to understand whether patients and families may have legal options. An investigation does not mean a lawsuit has been filed, and it does not mean that data has been misused. It means lawyers are gathering information from people who received notice so they can assess whether legal action may be possible as more facts come out.
When Did This Breach Occur?
According to its notice, Hospice of Murray County experienced the data security incident on August 24, 2026. The organization sent its notice on October 13, 2026, and the same date appears as the submission date on the federal health breach portal. The notice does not say when the organization first detected the incident, or whether the activity continued after August 24, 2026, and those details have not been made public. Because the review was described as ongoing, the organization may share more about the timeline later.
What Information Was Breached?
Hospice of Murray County said the information stored on the affected server may have included names and other identifying information, Social Security numbers, health insurance information, and medical and other protected health information. The notice says the organization is not aware of any protected health information that has been compromised, but that it cannot rule out that personal or sensitive information was affected. Not every person receiving a notice will have had every type of information involved, so read your own notice closely to see what applies to you.
What You Can Do
If you received a notice from Hospice of Murray County or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- If you are a patient or family member of a patient, keep an eye out for mail from the organization and do not ignore it, since it describes the steps being taken.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Hospice of Murray County
Attorneys are investigating the Hospice of Murray County data security incident and want to hear from patients and family members who received a notice. A lawsuit has not been confirmed, and whether you can seek compensation depends on what the organization ultimately confirms about the information involved. If you received a notice or believe your information was exposed, an attorney can explain whether you may be able to join a class action lawsuit.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
