McAlester Regional Health Center
Disclosed Aug 21, 20233 years ago37,731 affectedConfirmed
The covered entity (CE), McAlester Regional Health Center, reported that it experienced a ransomware attack that compromised the protected health information (PHI) of 37,731 individuals. The PHI involved included names, Social Security numbers, financial information, and treatment information. The CE notified HHS, affected individuals, the media, and provided substitute notice on its website. In response to the breach, the CE implemented additional administrative and technical safeguards to better protect sensitive data. OCR provided technical assistance regarding the HIPAA Rules.
What is known
| People affected | 37,731 (as reported to HHS) |
|---|---|
| Disclosed | Aug 21, 2023 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Vermont Attorney General: 2023-11-15 McAlester Regional Health Center Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): McAlester Regional Health Center (Healthcare Provider, OK)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Aug 21, 2023 | 37,731 |
| Vermont AGresidents of VT | Nov 15, 2023 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 37731 · backfill source
- 2026-09-25 · disclosed: 2023-11-15 to 2023-08-21 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), McAlester Regional Health Center, reported that it experienced a ransomware attack that compromised the protected health information (PHI) of 37,731 individuals. The PHI involved included names, Social Security numb · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Vermont AG), confirmed by Vermont AG. Record counts are as reported. Not legal advice.