Grafton City Hospital Data Breach: What Patients Need to Know

According to a notice of data security incident issued by Grafton City Hospital, Inc. and reported by West Virginia news outlets in late August 2026, the hospital states that an email account was compromised on May 6, 2026. The hospital reports that it secured its network, engaged additional third-party experts, enhanced its data security, and commenced an investigation, which determined that certain personal or medical information could have been subject to unauthorized activity.

Grafton City Hospital is affiliated with Mon Health, part of the Vandalia Health system, and the incident appears to be connected to a broader phishing attack that affiliate Mon General disclosed for the same date. In its own notice, Mon General states that on May 6, 2026, it discovered a small number of email users had been the subject of a phishing attack, that unauthorized access to certain mailboxes was terminated the same day, and that its investigation concluded in late June 2026 with no other systems or data storage impacted. Grafton City Hospital reported its portion of the incident to the U.S. Department of Health and Human Services on August 22, 2026.

Grafton City Hospital’s public statements describe the affected data as certain personal or medical information that could have been subject to unauthorized activity, without publicly itemizing the specific categories. Individual notification letters would typically describe the information involved for each person.

For context, the notice issued by affiliate Mon General for the same phishing event states that the information involved varied by person but may have included first and last name, date of birth, email address, phone number, Social Security number, health information, and health insurance information. Grafton City Hospital’s letters may describe different categories, so patients should rely on their own notice. Where identifiers such as Social Security numbers may have been exposed alongside health information, there can be an increased risk of identity theft, medical identity theft, or targeted phishing, even where a hospital reports no known misuse.

The HHS Office for Civil Rights breach portal lists 1,215 individuals as affected by the Grafton City Hospital incident, categorized as a hacking/IT incident involving email. The individuals potentially affected are likely to be current or former patients whose information was present in the compromised mailbox, though the hospital has not published a breakdown.

The hospital has stated that those affected have been contacted. If you are a current or former Grafton City Hospital patient and received a letter referencing this incident or an offer of free credit monitoring, that notice may indicate your information was among the data reported to have been affected.

Grafton City Hospital reports that it secured its network, brought in additional third-party experts, enhanced its data security, and investigated the incident, and that there does not appear to be any misuse of the affected information. The hospital states that affected individuals have been contacted and offered free credit monitoring and other services.

The hospital has not publicly specified the duration or provider of the monitoring in its public statements; affiliate Mon General’s notice for the same event describes two years of credit monitoring with enrollment instructions in the mailed letters. If you received a letter, it should contain the enrollment details and any deadline, so reviewing it closely can help you take advantage of the offered services in time.

While Grafton City Hospital has reported no apparent misuse, affected patients may wish to consider a few precautionary steps:

• Enroll in the offered credit monitoring. If your letter includes enrollment instructions, consider activating the service before any stated deadline.
• Review your Explanation of Benefits statements. Watch for medical claims or services you did not receive, which can be a sign of medical identity theft.
• Check your credit reports. You are entitled to free annual credit reports at annualcreditreport.com, and you can watch for accounts or inquiries you do not recognize.
• Consider a fraud alert or credit freeze. These are available at no cost through Equifax, Experian, and TransUnion and can add a layer of protection.
• Stay alert to phishing. Because this incident began with a phishing attack, be especially cautious of unexpected emails, calls, or texts referencing the hospital or the incident, and verify communications through official channels.

This information is a general overview and is not legal advice; your situation may differ, and consulting a legal professional can help you understand rights that may apply to you.

If your health information or personal data may have been involved in the Grafton City Hospital data breach, do you know what your options are? Our nationally recognized, award-winning team is here to help you understand your rights. Wilshire Law Firm offers free consultations and free case reviews with a legal professional, and we are available 24/7. Because we work on a contingency basis, there are no fees unless you get paid.

Contact Wilshire Law Firm today to schedule your free case review and get your questions answered.