Murray-Calloway county hospital reports third party breach exposing patient information
Learn More
Murray-Calloway County Hospital in Kentucky is reporting a data breach exposing personal and medical information of patients.
The incident is caused by a cyberattack on Blue & Company, LLC, a third-party financial consulting firm that provides auditing services to the hospital. The incident occurred in November 2024.
The investigation, which was completed on May 20, 2025, confirmed that personal health information provided to Blue & Co. by its healthcare clients was compromised. The company then worked to gather address information for impacted individuals before beginning the notification process. Starting on July 8, 2025, Blue & Co. began sending direct notification letters to potentially affected individuals for whom valid mailing addresses were available.
The number of affected individuals are not disclosed.
Affected individuals are offered complimentary credit monitoring services.
