Esse Health cyber incident

Analyst assessment

Esse Health’s April 2025 cyber incident interrupted outpatient care and access to network-dependent information in the St. Louis area. The provider’s own notice dates suspicious activity and unauthorized network access to April 21. It says an intruder viewed and copied files. These findings establish a confirmed cyber incident and data theft with high confidence; they do not establish the initial access technique or a ransomware family.

Our May 7 report described continued disruption. In First Alert 4’s May 6 reporting, named patients described difficulty transferring records and an April 30 appointment canceled because the office could not access records. The provider confirmed that it was investigating unusual network activity with outside specialists. These are concrete consequences for patient services, beyond a privacy incident alone.

Operational significance

Esse Health said its offices remained open and continued serving patients while some network systems were offline. It used backup processes and directed patients to text their doctor’s office or use the patient portal because telephone capabilities were limited. Continued office operations therefore coexisted with delayed or canceled care and impaired communication.

A May 13 update reported restored information-sharing functions and improved ability to schedule appointments, while warning that phone limitations continued. By its June 2 update, the provider said phones and other primary patient-facing network systems had been restored and regular contact channels were available again. The operational incident is resolved on that evidence. The reviewed updates establish restoration by June 2, without identifying the exact final restoration day; the prior draft’s May 26 end date is unsupported.

Confidence and uncertainty

The provider’s current notice identifies potentially involved contact details, birth dates, insurance information, patient and medical record identifiers, and certain health information, varying by person. It also includes Social Security numbers for a limited subset. That qualified primary finding takes precedence over July 1 reporting that said no Social Security numbers were stolen. The same report put initial notifications at 263,601 individuals; that is an attributed historical notification count.

Esse Health said its electronic medical record system was not accessed or copied. This does not contradict patients’ inability to obtain records during the outage: availability to patients and staff is a different question from intruder access to that system. The evidence does not establish that every office or patient experienced the same disruption.

The July report suggested ransomware as a possibility based on the recovery period, but did not identify a confirmed mechanism or actor. Name, domain and legal-name claim searches found no matching listing. Ransomware involvement and threat-actor attribution remain unresolved.

Analytic gaps

The reviewed evidence does not establish the entry route, encryption scope, a ransom demand, payment or misuse of the copied information. Anonymous allegations about earlier privacy practices are not verified findings about this incident.

Subsequent litigation does not extend the operational outage. The signed and filed Aug. 3, 2026, court order granted final approval of the settlement in Clausner v. American Multispecialty Group, doing business as Esse Health, case 2622-CC00414. It expressly made no finding of liability or wrongdoing. The administrator’s older proposed-settlement wording does not override that order; the reviewed material does not establish payment distribution or an appeal outcome.