By HFT Staff

Watsonville Community Hospital (WCH) is providing notice of a recent data security event, which is still under investigation. As they continue to investigate and work toward notifying impacted individuals directly, they are providing information about the event, our response and steps potentially impacted individuals can take to protect their information, should they feel it is appropriate to do so. 

WCH became aware of suspicious activity related to certain systems within their computer network. In response, they promptly took portions of our network offline, isolated the affected system and began an investigation into the activity with the assistance of third-party specialists. The investigation determined there was unauthorized access to a limited subset of their network between November 25, 2024, and November 30, 2024, and that certain files within the network were accessed or downloaded without authorization during that time. 

While WCH’s investigation was ongoing, they began notifying potentially affected individuals via their website and media notice. As part of their response efforts, they performed a comprehensive and time-intensive third-party review of the impacted files to determine what information was contained within the files and to whom the information relates. This review was completed on or about September 22, 2025. Following the third-party review, they undertook a detailed internal review of their records to identify contact information for affected individuals to provide this notification. WCH recently concluded this review and is continuing to notify identified individuals. 

Based on their investigation to date, they determined that the impacted information varies by individual but may include name, address, medical record number, full or partial Social Security number, date of birth, tax ID number, driver’s license/government ID number, passport number, financial account information, payment card information, access credentials, birth certification, clinical or treatment information, medical procedure information, medical provider name, prescription information or health insurance information. 

Upon learning of this event, WCH moved quickly to investigate and respond to the incident, assess the security of our systems, restore functionality to their IT network and notify potentially affected individuals. They reviewed and enhanced their technical, administrative and physical safeguards, policies and procedures to further secure the information on their systems. WCH also reported this incident to the Federal Bureau of Investigation who is responsible for investigating these cyber events, and appropriate state and federal data privacy regulators.