INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Bacon County Health Services Hit by Cyber Attack

| 2026-10-09 14:43 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
Bacon County Health Services, a nonprofit healthcare organization in Alma, Georgia, is investigating a data security incident involving unauthorized access to systems containing patient information that occurred between July 10 and July 27, 2026. The investigation confirmed that an unauthorized third party had accessed its computer network during this time period, resulting in the exfiltration of files containing patient information. At least 501 individuals are believed to be affected by the breach, although the total number will be updated when the data review is concluded. The incident may not have resulted in misuse of the affected data at the time it was announced, but Bacon County Health Services has warned all patients to remain vigilant against identity theft and fraud.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
GE
financefinance healthhealth
Incident Timeline
‎April 27, 2025
Threat actors used a phishing email campaign to target Bacon County Health Services, which was subsequently reported by the Finance department on April 27, 2025.
industry Health
General Document Context
industry Finance
General Document Context
‎between April 27, 2025
Threat actors used unknown means to target the PDCM Insurance network between April 27, 2025, and April 28, 2025.
‎April 28, 2025
Threat actors used social engineering tactics to gain unauthorized access to files and folders within the PDCM Insurance network between April 27, 2025, and April 28, 2025.
industry Health
General Document Context
industry Finance
General Document Context
‎February 12, 2026
Threat actors used unknown methods to trigger suspicious network activity on February 12, 2026.
industry Health
General Document Context
industry Finance
General Document Context
tactic Data Breach
According to the practice’s substitute data breach notice, suspicious network activity was identified on February 12, 2026.
‎June 17, 2026
Crypto24 claimed to have exfiltrated sensitive data, including patients' protected health information from Imagine the Possibilities.
industry Health
General Document Context
industry Finance
General Document Context
organisation Social Security
The investigation and data review were completed on June 17, 2026, confirming that the impacted data included names, dates of birth, Social Security numbers, financial account numbers, payment card information, government-issued ID numbers, medical information, and health insurance information.
organisation Crypto24
While not described as a ransomware attack, a ransomware group called Crypto24 claimed to have exfiltrated sensitive data, including patients’ protected health information.
organisation PDCM Insurance
The security incident occurred at one of its business associates, the Waterloo, IA-based insurance agency PDCM Insurance.
‎July 10, 2026
Threat actors used a phishing email campaign to target Bacon County Health Services' finance department on July 10, 2026.
industry Health
General Document Context
industry Finance
General Document Context
‎between July 10, 2026
Threat actors gained unauthorized access to Bacon County Health Services' computer network between July 10, and July 27, 2026.
‎July 27, 2026
Unauthorized third-party access to Comprehensive Orthopaedics & Musculoskeletal Care's computer network occurred between July 10, 2026, and July 27, 2026.
industry Health
General Document Context
industry Finance
General Document Context
organisation HHS’ Office for Civil Rights
To meet breach reporting requirements, the HHS’ Office for Civil Rights has been informed and provided with an estimate of at least 501 affected individuals.
‎Oct 9, 2026
Threat actors used an unspecified method to gain unauthorized access to systems containing patient information at Bacon County Health Services.
target_region Georgia
Bacon County Health Services Investigating Cyber Incident Posted By Steve Alder on Oct 9, 2026 Data breaches have been announced by Bacon County Health Services in Georgia, Comprehensive Orthopaedics & Musculoskeletal Care in Connecticut, Imagine the Possibilities in Iowa, and Health Plans Inc. in Massachusetts.
organisation Comprehensive Orthopaedics & Musculoskeletal Care
Bacon County Health Services Investigating Cyber Incident Posted By Steve Alder on Oct 9, 2026 Data breaches have been announced by Bacon County Health Services in Georgia, Comprehensive Orthopaedics & Musculoskeletal Care in Connecticut, Imagine the Possibilities in Iowa, and Health Plans Inc. in Massachusetts.
organisation Imagine the Possibilities
Bacon County Health Services Investigating Cyber Incident Posted By Steve Alder on Oct 9, 2026 Data breaches have been announced by Bacon County Health Services in Georgia, Comprehensive Orthopaedics & Musculoskeletal Care in Connecticut, Imagine the Possibilities in Iowa, and Health Plans Inc. in Massachusetts.
organisation Health Plans Inc.
Bacon County Health Services Investigating Cyber Incident Posted By Steve Alder on Oct 9, 2026 Data breaches have been announced by Bacon County Health Services in Georgia, Comprehensive Orthopaedics & Musculoskeletal Care in Connecticut, Imagine the Possibilities in Iowa, and Health Plans Inc. in Massachusetts.
industry Health
General Document Context
industry Finance
General Document Context
organisation Twin Oaks Convalescent Center
Bacon County Health Services provides healthcare services to individuals in and around Alma through Bacon County Hospital, Twin Oaks Convalescent Center, and a rural health clinic.
‎2026/10/09
Threat actors launched a cyber attack on Bacon County Health Services on October 9, 2026.
organisation Bacon County Health Services
Bacon County Health Services Investigating Cyber Incident.
Intelligence Sources
HIPAA Journal 2026-10-09