A July 2025 cyberattack disrupted phones, health records and patient access at Coös County Family Health Services. Recovery was phased; later findings confirmed unauthorized server access and potential exposure of patient information.
Unauthorized access to systems, accounts, networks, or data.
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
A service, system, platform, or operational capability remained available only in part or with significant limitations.
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.
The actor explicitly threatened to publish or publicly release victim data or incident details.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
Coös County Family Health Services, a nonprofit health care provider based in Berlin, New Hampshire, experienced a cyberattack in July 2025. Its privacy notice dates detection and unauthorized server access to July 9. Telephone and computer disruption affected patient services, with recovery occurring in stages.
Our July 25 report, citing provider Facebook updates, says the organization acknowledged the cyberattack July 10. Telephone service and the electronic health record system were restored by July 15, while its Berlin dental office remained closed. The patient portal returned July 22, restoring refill requests, care-team messages and test-result access. These milestones do not establish the dental office’s reopening date or complete recovery across every system.
Operations are presumed resolved given the reported restoration milestones and the time elapsed since the July 15 observation of continuing impairment. The exact end remains unknown. Later notifications and settlement activity concern information exposure and legal response; they do not establish a continuing outage.
Confidence is high in a cyber-related service disruption. The provider confirmed access to its servers and said an intruder could have examined or copied files containing identifying and health information. Its notice does not confirm that all potentially affected information was stolen or published. HIPAA Journal’s updated report attributes a total of 40,185 affected people, including 1,222 Maine residents, to a regulatory filing. These remain attributed figures rather than independently verified filing totals.
DeXpose reported that RunSomeWares listed the provider Aug. 13 and threatened a data release unless contacted. A matching Ransomware.live lead supports the existence of the allegation. Responsibility remains unconfirmed by the provider; the listing does not establish encryption, an actual release or a ransom payment.
The provider offered notification and credit-monitoring assistance. A court-authorized settlement website documents litigation and settlement administration concerning the July 9 incident, while stating that the defendant denies liability.
The initial access method, full intrusion window, encryption, ransom amount or payment, actual leak publication and precise completion of operational recovery remain unestablished. The Berlin dental office’s reopening date is also unknown. Reported phone, records-system and portal restoration dates establish individual milestones without supplying a final recovery day.
RunSomeWares listing is an unverified responsibility and data-extortion allegation, matched to coosfamilyhealth.org. DeXpose’s August 14 report describes the August 13 threat to publish data unless contacted. Provider confirms server access but does not name this actor or confirm encryption, publication or ransom payment.
Berlin anchors the affected provider and the specifically reported dental-office closure. This relation does not establish an outage at every provider location or a citywide impact.
Signed-in members can report an error, update, or missing source.
