Minnesota Epilepsy Group, a Level 4 epilepsy center in Roseville, Minnesota, has filed its second breach notice of 2026. The first ran from March 16 to April 10 and affected 80,061 people. The second was detected on August 10, four months after the prior access was terminated, and reached 82,574. The center says it does not know whether the two are connected.
What the August intrusion touched
Investigators confirmed an unauthorized party had access to parts of the network on August 10. File review finished September 17, when the practice established that patient information was compromised. Data types varied by person and included names paired with addresses, dates of birth, Social Security numbers, treatment information or health insurance details. Letters went out starting October 16, no misuse had been identified, and credit monitoring was offered where Social Security numbers were involved.
Reinfection is the finding that matters
Two almost identically sized breaches at one specialty practice in a single year is the signature of a half-cleaned compromise rather than two unrelated crimes. Specialty groups serving seizure patients run tightly scheduled EEG and imaging pathways, so weeks of downtime hit care directly. When a threat actor’s access is terminated, the work that actually ends the incident comes after: full credential rotation including service accounts, a sweep for scheduled tasks and remote monitoring agents, mailbox rule review, and a rebuild of any host the intruder touched. The practice says it had already improved security after the first event and is adding more now, which suggests the first round of fixes did not reach whatever the intruder used to return.
