Cookeville Regional Medical Center Hospital Breach (2025): Patient SSN & Home Address Exposed

About Cookeville Regional Medical Center

Cookeville Regional Medical Center (CRMC) is a 309-bed regional hospital based in Cookeville, Tennessee, serving the Upper Cumberland region across fourteen counties. The hospital provides emergency care, inpatient services, and a broad set of outpatient programs, with the surrounding system handling approximately 47,000 emergency room visits, 13,000 inpatient admissions, and nearly 200,000 outpatient visits annually. CRMC employs around 2,660 staff including 285 physicians. As a HIPAA-regulated regional hospital, CRMC maintains substantial volumes of protected health information including patient identity, insurance, billing, diagnostic, and treatment records across its hospital and outpatient operations.

Why They Hold Your Data

Regional medical centers collect patient identity, contact, insurance, billing, appointment, and clinical records across hospital and administrative workflows.

Recent Developments

CRMC discovered the ransomware attack on July 14, 2025 when unusual network activity caused a technical outage. The hospital reported the incident publicly on July 15, 2025, secured systems with assistance from outside cybersecurity experts, and notified law enforcement. The Rhysida ransomware-as-a-service group claimed responsibility on August 2, 2025 by listing CRMC on its dark-web leak site and demanding a ransom of 10 Bitcoin (worth approximately \$1.15 million at the time). Rhysida subsequently published the stolen data freely after failing to find a buyer. CRMC mailed breach notification letters to affected individuals on April 14, 2026, approximately nine months after detection. The hospital is offering twelve months of complimentary identity theft protection through Experian.

Data Points Exposed

Breach Impact

CRMC faces significant institutional exposure given the size of the affected population relative to its regional service area. Federal HIPAA notification obligations, an Office for Civil Rights review, multistate attorney-general filings, and active class-action litigation discussions are all underway. The CRMC incident ranks as the eighth-largest U.S. healthcare ransomware breach of 2025 by records compromised. Operationally, the ransomware attack caused a technical outage that disrupted scheduling and X-ray result delivery for several days, with reported delays for outpatient appointments and surgeries. The reputational impact is concentrated within the Upper Cumberland region of Tennessee, where CRMC is the dominant regional hospital and patient retention is unusually consequential.

Exploitation & Downstream Threats

• Identity theft and synthetic identity construction using government-issued IDs | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure

What You Should Do

1. Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
2. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
3. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
4. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).