The Madison County Health Department (“MCHD”) is providing this online notice about a data breach that exposed the personal information of 71 individuals, and to explain the circumstances of the incident.

What happened?

On October 14, 2025, MCHD discovered an unknown malicious actor (“Threat Actor”) had accessed one employee’s email account. MCHD performed a diligent investigation and confirmed that a limited number of emails in that single inbox were unlawfully accessed.

What information was involved?

MCHD determined the exact files and contents which were accessed by Threat Actor. After reviewing the files, it identified the following data elements in the accessed files: first and last name, individually identifiable health information, and one individual’s Social Security Number.

What we are doing.

MCHD is committed to the confidentiality and security of health information and continues to evaluate and enhance its security protocols. Upon discovery, MCHD promptly reset the compromised credentials and engaged a digital forensic investigator to determine the full extent of the security incident. MCHD has implemented enhanced security protections and taken steps to make a similar incident less likely.

We are also offering complimentary credit monitoring and identity theft protection services to any affected individual.

What affected individuals can do.

We mailed a written notice to affected individuals. If you have received notice that you were affected, use the instructions enclosed in your notice letter to enroll in complimentary credit monitoring and identity theft protection services from Epiq. Additionally, the Federal Trade Commission (“FTC”) recommends that affected individuals place a free fraud alert on your credit file by contacting any one of the three major credit bureaus. A fraud alert tells creditors to contact you before they open any new accounts or change your existing accounts. As soon as one credit bureau confirms your fraud alert, the others are notified to place fraud alerts. The initial fraud alert stays on your credit report for one year. You can renew it after one year.

If you have received notice that you were affected, you may ask each credit bureau to send you a free credit report after it places a fraud alert on your file. Review your credit reports for accounts and inquiries you don’t recognize. These can be signs of identity theft. If your personal information has been misused, visit the FTC’s site at IdentityTheft.gov to report the identity theft and get recovery steps. Even if you do not find any suspicious activity on your initial credit reports, the FTC recommends that you check your credit reports periodically so you can spot problems and address them quickly.  You may also contact the Office of the Kentucky Attorney General.

If you have received notice that you were affected, you may also want to consider placing a free credit freeze. A credit freeze means potential creditors cannot get your credit report. That makes it less likely that an identity thief can open new accounts in your name. A freeze remains in place until you ask the credit bureau to temporarily lift it or remove it.

To obtain information about how you can take steps to avoid identify theft, you may contact major credit reporting agencies using the below contact information.

In addition, affected individuals may obtain information about steps you may take to avoid identity theft from the Federal Trade Commission or Kentucky Attorney General by contacting them at the following:

For more information.

Individuals may call (859) 626-4241 to ask questions, Monday through Friday, between 8:00 a.m. and 4:30 p.m. Eastern Time, excluding major U.S. holidays.

Protecting your personal information is important to us. We trust that the services we are offering to you demonstrate our continued commitment to your security and satisfaction.

Sincerely,

Nikita Vundi

Public Health Director and HIPAA Compliance Officer