Minnesota healthcare breach data

A breach can involve an organization located in one state while notices about the same event appear through several other states. This page keeps those apart: 33 events involve an organization located in Minnesota, and 14 appear through Minnesota notice activity. Reconciled from 48 source records under Canonical Data Model 1.1.

Events at organizations located in Minnesota

Events with Minnesota notice activity

194.1M

Reported affected, event totals

Hacking / IT incident

Most common mechanism

The two counts above answer different questions and are not added together: one says the breached organization is located in Minnesota, the other says a notice about the event appears through Minnesota. Neither states where an incident physically happened, which these sources do not establish. Reported affected is an event total, not a count of Minnesota residents: unless a source scopes its figure to one state, it covers everyone the breach affected anywhere. For the same reason state figures do not sum to the national total — one breach reported through several jurisdictions is one event appearing under each of them. How these numbers are calculated.

Recent events

Latest breach events reported in Minnesota

Jul 21, 2026·3,640 reported affected·Hacking / IT incident·1 source record
Blue Cross Blue Shield of Minnesota
Reported to HHS OCR.
Jul 20, 2026·1,491 reported affected·Hacking / IT incident·1 source record
Beltrami County Health and Human Services
Reported to HHS OCR.
Jul 19, 2026·3,656 reported affected·Hacking / IT incident·1 source record
Minnesota Health Insurance Network
Reported to HHS OCR.
Jun 26, 2026·1,718 reported affected·Hacking / IT incident·1 source record
SKR Group, Inc.
Reported to HHS OCR.
Jun 17, 2026·83,114 reported affected·Hacking / IT incident·1 source record
Aitkin County Health and Human Services
Reported to HHS OCR.
Jun 5, 2026·80,061 reported affected·Hacking / IT incident·1 source record
Minnesota Epilepsy Group, P.A.
Reported to HHS OCR.
Apr 29, 2026·5,385 reported affected·Hacking / IT incident·1 source record
Northwoods Surgery Center
Reported to HHS OCR.
Apr 10, 2026·500 reported affected·Hacking / IT incident·1 source record
CARE Clinic
Reported to HHS OCR.
Mar 25, 2026·500 reported affected·Hacking / IT incident·1 source record
Securian Financial
Reported to HHS OCR.
Mar 10, 2026·5,385 reported affected·Hacking / IT incident·1 source record
illumifin Corporation
Reported to HHS OCR.
Mar 6, 2026·5,073 reported affected·Hacking / IT incident·1 source record
County of Murray dba Murray County Medical Center
Reported to HHS OCR.
Feb 13, 2026·501 reported affected·Hacking / IT incident·1 source record
Cedar Valley Services
Reported to HHS OCR.

Most affected entities

Organizations in Minnesota by breach events

Minnesota Department of Human Services

events

308.3K

reported affected

Mayo Clinic

events

76.9K

reported affected

Minnesota Mental Health Services

events

61.2K

reported affected

North Star Behavioral Health

events

60.8K

reported affected

Change Healthcare, Inc.

event

192.7M

reported affected

Incident mechanisms

How breaches happen in Minnesota

How the 47 canonical breach events with a Minnesotasource record were caused, as stated by the reporting source. An event is counted once regardless of how many times it was filed.

Hacking / IT incident27 (57%)
Unauthorized access or disclosure8 (17%)
Unknown mechanism7 (15%)
Misconfiguration2 (4%)
Ransomware / malware2 (4%)
Theft or loss1 (2%)

Minnesota compliance requirements

Minnesota breach notification law

Beyond federal HIPAA requirements, Minnesota has its own breach notification law that may impose additional obligations on healthcare practices operating in the state.

Minn. Stat. § 325E.61, subd. 1(a)

Notification deadline

In the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. No numeric outer bound in the general breach statute.

State regulator notice

Not required

None. § 325E.61 does not impose an Attorney General notification obligation on private (non-government) entities. Government entities notify the Legislative Auditor / State Auditor under the separate Minnesota Government Data Practices Act at § 13.055 — that section applies only to government entities and does NOT extend to private healthcare practices.

Minnesota Health Records Act governs authorized disclosure, not breach notification

The Minnesota Health Records Act at § 144.291-.298 is often cited as if it were a healthcare-specific breach law. It is not. § 144.293 addresses release of health records upon patient consent and specified exceptions; § 144.298 addresses penalties. Neither creates a breach-notification obligation that layers on top of HIPAA. HIPAA-regulated practices operating in Minnesota should not adopt § 144.291-.298 as a healthcare breach-notification framework — the applicable general-breach obligation lives at § 325E.61 and applies to the person's personal-information holdings, not to PHI as such.

Minnesota Consumer Data Privacy Act (Chapter 325M) is a separate controller regime

The Minnesota Consumer Data Privacy Act at Minn. Stat. § 325M.10-.21 (enacted 2024, generally effective July 31, 2025 for large controllers) imposes controller and processor obligations including consumer rights of access, correction, deletion, portability, and opt-out. It runs alongside § 325E.61 and does not modify the § 325E.61 breach-notification obligation. Importantly, the MCDPA does NOT use a blanket entity-level HIPAA covered-entity or business-associate exemption. Instead, § 325M.12 uses TARGETED DATA-LEVEL exclusions — specific categories of health-related information are excluded from the MCDPA's scope, including protected health information governed by HIPAA, health records governed by the Minnesota Health Records Act (§ 144.291-.298), information governed by Part 2 of 42 CFR (substance-use-disorder patient records), and certain intermingled health data held by covered entities, business associates, or healthcare providers. An entity that is a HIPAA CE or BA is therefore NOT automatically outside the MCDPA — data holdings that fall outside those health-related categories (e.g., employee data, marketing lists, non-patient records) remain subject to the MCDPA independent of the entity's HIPAA status.

2025-2026 currentness note

§ 325E.61 substantive text confirmed against revisor.mn.gov current text on 2026-08-23. No 2025 or 2026 Minnesota amendments to § 325E.61 identified. The MHRA definitional section § 144.291 subd. 2 was amended by 2025 c 20 s 118 — that amendment does not modify § 325E.61 breach-notification obligations. If a future Minnesota session amends § 325E.61, this record must be re-verified.

This is a general reference based on current Minnesota law. Consult legal counsel for state-specific compliance obligations. Source: Minn. Stat. § 325E.61, subd. 1(a). Per-jurisdiction verification status and primary-source references are shown on each specialty/state compliance page.

Protect your Minnesota practice

47 breach events in Minnesota. Is your practice next?

Patient Protect gives independent practices real-time compliance monitoring, breach prevention, and secure workflows — so your practice stays out of this database. Starting at $39/month.

Start free trial Get your Patient Protect Score — free

14-day free trial · No charge until trial ends

FAQ

Healthcare breaches in Minnesota

How many healthcare data breaches have been reported in Minnesota?

33 canonical breach events involve an organization located in Minnesota, and 14 appear through Minnesota notice activity. Those are different relationships and are not added together — a breach at an organization elsewhere can be notified through Minnesota. Together the events on this page report 194.1M individuals affected, an event total counting everyone each breach affected anywhere, not a count of Minnesota residents. Sourced from HHS OCR breach reports and state attorney general notices, reconciled under Patient Protect Canonical Data Model 1.1. Updated nightly.

What is the most common breach mechanism in Minnesota?

The most frequently reported incident mechanism in Minnesota is Hacking / IT incident, present in 27 of 47 canonical breach events. Unauthorized access or disclosure follows with 8.

Are independent practices in Minnesota at higher risk?

Independent healthcare practices are the fastest-growing target for healthcare cyberattacks nationwide — attacks on small providers have increased 6x since 2021. Minnesota practices face the same threat landscape with fewer resources to defend against it. Patient Protect provides breach prevention specifically for independent practices starting at $39/month.

What are Minnesota's breach notification requirements?

Minnesota requires breach notification in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. No numeric outer bound in the general breach statute. These requirements apply alongside federal HIPAA's 60-day notification deadline. Reference: Minn. Stat. § 325E.61, subd. 1(a).

Explore the full breach intelligence dashboard — the landscape by mechanism and jurisdiction, the organizations appearing in the record, and every underlying source record.

Open full dashboard

Data Disclaimer: This page counts canonical breach events reconciled from the HHS OCR Breach Portal and state attorney general breach notifications under Patient Protect Canonical Data Model 1.1. Regulatory enforcement actions, security advisories, community reports and algorithmically modeled records are held separately and are not counted here. Data is provided “as-is” for informational purposes only. Inclusion of any entity does not imply wrongdoing. Users must independently verify information before relying on it. See Terms of Use.

Minnesota healthcare breach data

Events at organizations located in Minnesota

Events with Minnesota notice activity

194.1M

Reported affected, event totals

Hacking / IT incident

Most common mechanism

Recent events

Latest breach events reported in Minnesota

Jul 21, 2026·3,640 reported affected·Hacking / IT incident·1 source record
Blue Cross Blue Shield of Minnesota
Reported to HHS OCR.
Jul 20, 2026·1,491 reported affected·Hacking / IT incident·1 source record
Beltrami County Health and Human Services
Reported to HHS OCR.
Jul 19, 2026·3,656 reported affected·Hacking / IT incident·1 source record
Minnesota Health Insurance Network
Reported to HHS OCR.
Jun 26, 2026·1,718 reported affected·Hacking / IT incident·1 source record
SKR Group, Inc.
Reported to HHS OCR.
Jun 17, 2026·83,114 reported affected·Hacking / IT incident·1 source record
Aitkin County Health and Human Services
Reported to HHS OCR.
Jun 5, 2026·80,061 reported affected·Hacking / IT incident·1 source record
Minnesota Epilepsy Group, P.A.
Reported to HHS OCR.
Apr 29, 2026·5,385 reported affected·Hacking / IT incident·1 source record
Northwoods Surgery Center
Reported to HHS OCR.
Apr 10, 2026·500 reported affected·Hacking / IT incident·1 source record
CARE Clinic
Reported to HHS OCR.
Mar 25, 2026·500 reported affected·Hacking / IT incident·1 source record
Securian Financial
Reported to HHS OCR.
Mar 10, 2026·5,385 reported affected·Hacking / IT incident·1 source record
illumifin Corporation
Reported to HHS OCR.
Mar 6, 2026·5,073 reported affected·Hacking / IT incident·1 source record
County of Murray dba Murray County Medical Center
Reported to HHS OCR.
Feb 13, 2026·501 reported affected·Hacking / IT incident·1 source record
Cedar Valley Services
Reported to HHS OCR.

Most affected entities

Organizations in Minnesota by breach events

Minnesota Department of Human Services

events

308.3K

reported affected

Mayo Clinic

events

76.9K

reported affected

Minnesota Mental Health Services

events

61.2K

reported affected

North Star Behavioral Health

events

60.8K

reported affected

Change Healthcare, Inc.

event

192.7M

reported affected

Incident mechanisms

How breaches happen in Minnesota

How the 47 canonical breach events with a Minnesotasource record were caused, as stated by the reporting source. An event is counted once regardless of how many times it was filed.

Hacking / IT incident27 (57%)
Unauthorized access or disclosure8 (17%)
Unknown mechanism7 (15%)
Misconfiguration2 (4%)
Ransomware / malware2 (4%)
Theft or loss1 (2%)

Minnesota compliance requirements

Minnesota breach notification law

Beyond federal HIPAA requirements, Minnesota has its own breach notification law that may impose additional obligations on healthcare practices operating in the state.

Minn. Stat. § 325E.61, subd. 1(a)

Notification deadline

State regulator notice

Not required

Minnesota Health Records Act governs authorized disclosure, not breach notification

Minnesota Consumer Data Privacy Act (Chapter 325M) is a separate controller regime

2025-2026 currentness note

Protect your Minnesota practice

47 breach events in Minnesota. Is your practice next?

Patient Protect gives independent practices real-time compliance monitoring, breach prevention, and secure workflows — so your practice stays out of this database. Starting at $39/month.

Start free trial Get your Patient Protect Score — free

14-day free trial · No charge until trial ends

FAQ

Healthcare breaches in Minnesota

How many healthcare data breaches have been reported in Minnesota?

What is the most common breach mechanism in Minnesota?

The most frequently reported incident mechanism in Minnesota is Hacking / IT incident, present in 27 of 47 canonical breach events. Unauthorized access or disclosure follows with 8.

Are independent practices in Minnesota at higher risk?

What are Minnesota's breach notification requirements?

Explore the full breach intelligence dashboard — the landscape by mechanism and jurisdiction, the organizations appearing in the record, and every underlying source record.

Open full dashboard

Minnesota healthcare breach data

Latest breach events reported in Minnesota

Blue Cross Blue Shield of Minnesota

Beltrami County Health and Human Services

Minnesota Health Insurance Network

SKR Group, Inc.

Aitkin County Health and Human Services

Minnesota Epilepsy Group, P.A.

Northwoods Surgery Center

CARE Clinic

Securian Financial

illumifin Corporation

County of Murray dba Murray County Medical Center

Cedar Valley Services

Organizations in Minnesota by breach events

Minnesota Department of Human Services

Mayo Clinic

Minnesota Mental Health Services

North Star Behavioral Health

Change Healthcare, Inc.

How breaches happen in Minnesota

Minnesota breach notification law

Minnesota Health Records Act governs authorized disclosure, not breach notification

Minnesota Consumer Data Privacy Act (Chapter 325M) is a separate controller regime

2025-2026 currentness note

47 breach events in Minnesota. Is your practice next?

Healthcare breaches in Minnesota

How many healthcare data breaches have been reported in Minnesota?

What is the most common breach mechanism in Minnesota?

Are independent practices in Minnesota at higher risk?

What are Minnesota's breach notification requirements?

Minnesota healthcare breach data

Latest breach events reported in Minnesota

Blue Cross Blue Shield of Minnesota

Beltrami County Health and Human Services

Minnesota Health Insurance Network

SKR Group, Inc.

Aitkin County Health and Human Services

Minnesota Epilepsy Group, P.A.

Northwoods Surgery Center

CARE Clinic

Securian Financial

illumifin Corporation

County of Murray dba Murray County Medical Center

Cedar Valley Services

Organizations in Minnesota by breach events

Minnesota Department of Human Services

Mayo Clinic

Minnesota Mental Health Services

North Star Behavioral Health

Change Healthcare, Inc.

How breaches happen in Minnesota

Minnesota breach notification law

Minnesota Health Records Act governs authorized disclosure, not breach notification

Minnesota Consumer Data Privacy Act (Chapter 325M) is a separate controller regime

2025-2026 currentness note

47 breach events in Minnesota. Is your practice next?

Healthcare breaches in Minnesota

How many healthcare data breaches have been reported in Minnesota?

What is the most common breach mechanism in Minnesota?

Are independent practices in Minnesota at higher risk?

What are Minnesota's breach notification requirements?

Latest verified Responses

CareCloud breach filing: what a revised scope means for vendor oversight

Madera Community Hospital breach filing: 150,000 individuals and exfiltration-scoped risk analysis

Brown Health Medical Group breach filing: 311,760 individuals and server-side safeguards