Cookeville Medical Center Notifies Patients of Data Breach
Cookeville Regional Medical Center (CRMC) in Tennessee has informed over 337,000 patients about a data breach stemming from a Rhysida ransomware attack in July 2025. The incident exposed sensitive patient information, including personal and medical records.
Cookeville Medical Center Confirms Rhysida Ransomware Attack
Cookeville Regional Medical Center (CRMC), a prominent healthcare provider in Tennessee, has recently announced a significant data breach affecting more than 337,000 patients. The incident was identified as a ransomware attack perpetrated by the Rhysida group in July 2025, leading to the unauthorized access and potential exfiltration of sensitive patient data.
Details of the Security Incident
The ransomware attack occurred in July 2025, but CRMC's notification to affected individuals was issued much later, specifically in April 2026. This delay underscores the complexity of forensic investigations and data breach response protocols, especially within the healthcare sector where patient privacy is paramount.
Impact on Patient Data
Investigations revealed that the attackers gained access to various categories of highly sensitive patient information. The compromised data may include:
Has your email been leaked? Check for free — results in seconds.
Check Now →- Patient Names
- Dates of Birth
- Social Security Numbers (SSNs)
- Medical Information (such as diagnosis, treatment details, and prescription data)
- Health Insurance Information
CRMC has stated that upon discovering the breach, immediate steps were taken to secure their systems and initiate a thorough investigation with the assistance of third-party cybersecurity experts. Affected individuals are being offered credit monitoring and identity theft protection services where applicable.
Recommendations for Affected Individuals
Patients who receive a notification from Cookeville Medical Center are advised to take proactive measures to protect themselves from potential identity theft and fraud:
- Review all financial statements and credit reports for any suspicious activity.
- Consider placing a fraud alert or security freeze on their credit files.
- Be vigilant against phishing attempts or unsolicited communications asking for personal information.
Healthcare organizations remain prime targets for ransomware groups due to the critical nature of their services and the high value of patient data on the black market. This incident serves as another reminder of the continuous need for robust cybersecurity defenses and incident response planning.
Source
https://www.infosecurity-magazine.com/news/cookeville-medical-center-data/