Over 100K exposed in Arkansas health system hack

Mainline Health Systems, an Arkansas-based healthcare organization, suffered a data breach over a year ago. The attackers potentially accessed personal patient details.

A data breach notification sent to impacted individuals revealed that attackers breached Mainline in April last year and accessed the organization's network. After learning about the breach, the company launched an investigation, which lasted over a year.

“Based on that review, we discovered on May 21st, 2025, that certain files containing your protected personal information were subject to unauthorized access or acquisition as a result of the incident,” reads Mainline’s notice.

Information that the company submitted to the Maine Attorney General’s Office shows that over 101,000 individuals were exposed in the hacker attack.

Mainline claims that attackers accessed patients’ names and addresses. Meanwhile, Murphy Law Firm, which is investigating the breach on behalf of individuals whose data may have been compromised, says the true extent of the breach is larger and includes:

• Social Security numbers (SSNs)
• Financial account information
• Payment card information
• Medical information
• Health insurance information
• Driver’s license numbers

Attackers could exploit the details for nefarious purposes, such as identity theft fraud. For example, malicious actors could attempt to set up fraudulent accounts or gain illegitimate access to medical services. Moreover, threat actors trade medical details on the dark web, as interested parties could purchase the details in order to gain access to prescription drugs.

However, Mainline’s breach notice stressed that the company has no information that any of the accessed details were exploited for identity fraud or to commit financial fraud. Despite that, the company said it will provide potential victims with identity protection and credit monitoring services.

The Arkansas-based Mainline Health Systems operates 28 primary and in-school clinics.