Missouri healthcare provider Esse Health is notifying over 263,000 people that their personal information was stolen in a disruptive April 2025 cyberattack.
The incident was discovered on April 21 and impacted the organization’s access to the electronic medical record system, while also taking down its phone system.
By May 13, the healthcare provider had restored certain systems and was able to fulfill scheduled appointments or procedures. The phone systems were restored in early June, along with other primary patient-facing network systems, the organization said in an incident notice.
On June 20, Esse Health said its investigation into the attack determined that a threat actor breached its network on April 21 and stole files containing personal information.
The exfiltrated data included names, addresses, dates of birth, Social Security numbers, medical record numbers, patient account numbers, health information, and health insurance details.
“As part of our ongoing commitment to the privacy and security of information in our care, we have implemented additional security enhancements to further strengthen our defenses. At this time there is no indication that any of the involved information has been misused,” the organization said.
However, Esse Health is providing the impacted individuals with 12 months of free identity protection services, as well as with guidance on how to prevent identity theft and fraud.
On Monday, the healthcare provider informed the Maine Attorney General’s Office that 263,601 individuals were impacted by the data breach.
Esse Health has not shared details on the type of cyberattack it fell victim to, but the network-wide disruption it suffered suggests that ransomware might have been involved. SecurityWeek has not seen any known ransomware group claiming responsibility for the incident.
Esse Health is an independent physician group healthcare provider that operates 50 locations across the Greater St. Louis area in Missouri.
