A cybercriminal accessed Baptist Health Medical Center-Drew County’s systems between August 2024 and acquired patient names, addresses, birth dates, diagnoses, treatment information, and medical record numbers for 5,207 individuals. A class action settlement now offers credit monitoring and loss reimbursement. Affected patients should file a claim by December 8, 2026, and monitor their credit and medical statements closely.
| Company | Baptist Health Medical Center-Drew County |
|---|---|
| Industry | Healthcare |
| Data Types Exposed | Names, Addresses, Birth Dates, Diagnoses, Treatment Information, Medical Record Numbers |
| People Affected | 5,207 individuals |
| Attack Method | Unauthorized Network Access |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Baptist Health Medical Center-Drew County Data Breach?
Baptist Health Medical Center-Drew County, a hospital in Arkansas, confirmed that a cybercriminal gained access to its computer systems and acquired patient information. The Baptist Health Medical Center-Drew County data breach involved unauthorized access that began on August 22 and continued until July 8, 2024. During that window, the intruder was able to view and potentially copy files containing sensitive patient details.
Hospitals store large volumes of patient records, which makes them frequent targets for cybercriminals. In this case, the attacker was able to move through the network undetected for an extended period. As a result, the organization had to conduct a thorough review of the affected systems once the intrusion was identified.
Following discovery, Baptist Health Medical Center-Drew County launched a forensic investigation to determine the scope of the compromise. The hospital then reported the incident to the HHS Office for Civil Rights, which tracks healthcare data breaches nationwide. This formal reporting step confirmed that patient data had, in fact, been accessed by an unauthorized party.
Who was affected?
The breach affected patients whose records were stored on the hospital’s systems during the period of unauthorized access. According to the HHS Office for Civil Rights filing, the protected health information of 5,207 individuals was involved. This means the incident reached a meaningful share of the hospital’s patient population.
Because the exposed data came from medical records, the affected group likely includes a broad range of patients treated at the facility. It is not clear whether minors were among those impacted, since the source does not specify age ranges. However, patients of all backgrounds who received care at Baptist Health Medical Center-Drew County during the relevant period should assume their information could be involved.
What Information Was Potentially Exposed?
The data compromised in this incident covered both personal identifiers and clinical details. This combination is particularly concerning because it links a patient’s identity directly to their medical history.
- Names
- Addresses
- Birth dates
- Diagnoses
- Treatment information
- Medical record numbers
Because this data includes diagnoses and treatment history, affected individuals face a heightened risk of medical identity theft. For example, a criminal could use stolen medical record numbers to file fraudulent insurance claims or obtain medical services under someone else’s name. This type of fraud can be especially difficult to detect and unwind.
In addition, the combination of names, addresses, and birth dates gives scammers enough information to craft convincing phishing messages. Fraudsters often use real personal details to impersonate healthcare providers or insurers. As a result, affected patients should treat unexpected calls or emails referencing their medical care with caution.
What is the company doing?
Baptist Health Medical Center-Drew County reported the breach to the HHS Office for Civil Rights, as required under federal law. This notification confirmed the scope of the incident as 5,207 affected individuals. The hospital has also engaged with the legal process surrounding the resulting class action lawsuit.
Although the hospital denies any wrongdoing, it agreed to resolve the consolidated lawsuit through a negotiated settlement. This agreement provides credit monitoring services, reimbursement for documented losses, and compensation for time spent responding to the incident. The settlement recently received preliminary court approval, with a final fairness hearing scheduled for February 4, 2027.
Under the settlement, class members can claim two years of single-bureau credit monitoring, which includes a $1 million identity theft insurance policy. Furthermore, individuals who spent time dealing with the aftermath of the breach may claim up to four hours of lost time at $20 per hour. Those who suffered documented financial losses can seek additional reimbursement as well.
What Should Affected Individuals Do?
Review Your Settlement Options
Affected individuals should determine whether they are eligible to file a claim under the settlement. Reimbursement is available for documented ordinary losses up to $400 incurred between April 22, 2024, and December 8, 2026. Those who experienced identity theft or fraud tied to this breach may claim up to $4,000 for extraordinary losses.
The deadline to submit a claim is December 8, 2026. Meanwhile, anyone wishing to object to the settlement or exclude themselves must act by November 9, 2026. Because these deadlines are firm, affected patients should gather documentation of any related expenses as soon as possible.
Monitor Your Credit Reports Regularly
Affected individuals should check their credit reports for unfamiliar accounts or inquiries. This is especially important since names, addresses, and birth dates were part of the exposed data. Reviewing reports from all three major credit bureaus gives a fuller picture of potential misuse.
In addition, the settlement offers two years of free credit monitoring with identity theft insurance. Enrolling in this service can help catch suspicious activity early. Consequently, affected patients should take advantage of this benefit rather than rely solely on self-monitoring.
Watch for Medical Identity Theft
Because diagnoses, treatment information, and medical record numbers were exposed, patients should watch closely for signs of medical identity theft. This can include unfamiliar bills, insurance statements for care never received, or calls about unpaid medical debt. Reviewing insurance explanation-of-benefits statements regularly can help catch this early.
If anything looks unfamiliar, contact your healthcare provider and insurer immediately. Reporting discrepancies quickly can limit the damage and help correct your medical records before errors become harder to fix.
Stay Alert for Phishing Attempts
Scammers often use stolen personal details to make phishing emails and calls seem legitimate. Affected individuals should be cautious of unexpected messages referencing their medical care or asking for personal information. Never click links or share details in response to unsolicited contact.
Instead, verify any suspicious communication by contacting the hospital or insurer directly using a known phone number. This simple step can prevent scammers from gaining further access to your accounts or personal information.
Consider Consulting a Data Breach Attorney
Individuals who experienced financial losses or identity theft tied to this breach may want to speak with a data breach attorney. An attorney can help determine whether you qualify for extraordinary loss reimbursement under the settlement. They can also advise on documentation needed to support a claim.
Because claim deadlines are approaching, affected patients should not delay seeking guidance if they believe they were harmed. A free case evaluation can clarify your options at no upfront cost.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.