What Happened in the KH Credit Union Data Breach?
KH Credit Union disclosed a data breach involving member information that was stored on Kettering Health’s network. The credit union reported the incident to the Massachusetts Office of Consumer Affairs and Business Regulation on June 16, 2026, and also published a notice regarding the breach.
According to the notice, Kettering Health became aware of suspicious activity affecting certain systems within its network on or about May 20, 2025. Following the discovery, Kettering Health secured its environment and launched an investigation with assistance from third-party cybersecurity specialists.
The investigation determined that unauthorized access occurred within Kettering Health’s environment between April 9, 2025, and May 20, 2025. During that period, certain files and folders may have been viewed or acquired without authorization.
KH Credit Union stated that the incident did not involve its own network and was limited to systems operated by Kettering Health.
Who was affected?
KH Credit Union has not publicly disclosed the total number of individuals affected by the incident.
The breach potentially impacts credit union members whose information was stored on Kettering Health’s network. KH Credit Union serves employees of Kettering Health and their families in the Dayton, Ohio area.
What Information was taken?
According to the breach notification, the following types of information may have been exposed:
- Full names
- Social Security numbers
- Bank account information
- Financial account information
- Driver’s license numbers
- State identification numbers
- Medical billing information
- Medical claims information
- Patient account numbers
The exposure of Social Security numbers and financial account information may increase the risk of identity theft and financial fraud. Additionally, medical information could potentially be used in healthcare-related scams or other fraudulent activities.
What Is KH Credit Union Doing?
According to the notification, Kettering Health conducted a comprehensive investigation with the assistance of external cybersecurity specialists to determine the scope of the incident.
Kettering Health is offering affected individuals 12 months of complimentary single-bureau credit monitoring, a single-bureau credit report, and a single-bureau credit score through Cyberscout.
Affected individuals can enroll in these services using the unique code provided in their notification letter. The enrollment deadline is September 12, 2026.
The organization has also established a dedicated toll-free assistance line for affected individuals. Representatives can be reached at 1-844-784-5351 Monday through Friday from 8:00 a.m. to 8:00 p.m. Eastern Time, excluding U.S. holidays.
What Should Affected Individuals Do?
Review Financial Statements
Carefully monitor bank accounts, credit cards, and other financial accounts for suspicious transactions or unauthorized activity.
Monitor Your Credit Reports
Review credit reports regularly for unfamiliar accounts, inquiries, or other signs of identity theft.
Consider a Fraud Alert
A fraud alert can encourage lenders to verify your identity before opening new accounts in your name.
Freeze Your Credit
A credit freeze may help prevent criminals from opening new credit accounts using your personal information.
Watch for Phishing Attempts
Be cautious of unsolicited emails, text messages, or phone calls requesting personal information. Cybercriminals often use data obtained during breaches to create convincing scams.
Enroll in Free Credit Monitoring
Individuals who received a notification letter should consider enrolling in the complimentary credit monitoring services being offered through Cyberscout before the September 12, 2026 enrollment deadline.