Bacon County Health Services

Summary

Bacon County Health Services, a nonprofit healthcare provider in Alma, Georgia, is investigating a data security incident after detecting suspicious network activity that revealed unauthorized third‑party access to its systems containing patient information. The forensic review determined that the intruder was present in the network for a period before the activity was identified and that files with patient data were exfiltrated. While the full scope of the breach, including the number of affected individuals and the specific data elements compromised, remains under review, the organization has notified the HHS Office for Civil Rights of an estimated minimum of five hundred impacted individuals and will send notification letters once the analysis concludes. At the time of the announcement no misuse of the exposed information had been observed, and patients have been advised to stay alert for potential identity theft or fraud.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Bacon County Health Services, a nonprofit healthcare organization based in Alma, Georgia that operates Bacon County Hospital, Twin Oaks Convalescent Center and a rural health clinic, identified suspicious network activity on July 27, 2026. A subsequent forensic investigation determined that an unauthorized third party had access to the organization's computer network from July 10, 2026 through July 27, 2026. The investigation confirmed that files containing patient information were exfiltrated by the threat actor during that period. At the time of the public announcement, the data review was still ongoing and the exact number of affected individuals and the specific types of data involved had not yet been determined. The organization stated that notification letters would be mailed to affected individuals once the data review was completed.

Although the incident may not have impacted every patient served by Bacon County Health Services, the organization advised all patients to remain vigilant against potential identity theft and fraud. No misuse of the exfiltrated data had been identified at the moment the incident was disclosed. To satisfy federal breach reporting obligations, Bacon County Health Services notified the HHS Office for Civil Rights and provided an initial estimate that at least 501 individuals were affected, noting that the total would be updated after the data review concluded. The organization provides healthcare services to individuals in and around Alma through its hospital, convalescent center and rural clinic.

The forensic investigation is continuing to examine the scope of the breach and to finalize the data review process. Upon completion of the review, Bacon County Health Services will send out the notification letters to those whose information was compromised. The organization has also indicated that it will update the HHS Office for Civil Rights with the final count of affected individuals once the review is finished. These steps constitute the documented response actions taken by Bacon County Health Services following the discovery of the unauthorized network access.

Sources

Sources available to members: 1 source.