Woodfords Family Services in Westbrook, Maine has reported a ransomware attack that compromised the personal and protected health information (PHI) of 8,073 individuals, including 7,701 Maine residents. The organization notified the Maine Attorney General and issued public notices following the incident.
Incident Timeline
Woodfords Family Services identified suspicious network activity on April 8, 2024. The investigation confirmed that the Medusa ransomware group had accessed the organization’s network. Immediate steps had been taken to investigate and secure systems. The forensic investigation concluded on May 30, 2024. Woodfords Family Services issued a preliminary breach notice on June 3, 2024, followed by media notice on June 7, 2024. Mailing of notification letters began in March 2025, with some individuals receiving letters only recently.
Woodfords Family Services initially conducted an internal investigation but determined that the full scope of the incident could not be identified. On September 25, 2024, the organization engaged data mining specialists to confirm affected individuals and the types of data involved. The data mining process concluded on October 3, 2025. Internal review was completed on January 29, 2026, mailing addresses were verified, and the final notification letters were mailed on March 27, 2026.
Data Compromised
The compromised information included names, Social Security numbers, driver’s license numbers, financial account information, medical insurance information, and diagnosis and treatment information. Affected individuals were given a free 12-month membership to credit monitoring and identity theft protection services.
Regulatory Reporting
As a HIPAA compliant entity, Woodfords Family Services reported the breach to the Department of Health and Human Services’ Office for Civil Rights in June 2024. The data breach report had a placeholder figure of 500 affected individuals. The total number is not yet updated due to delays by OCR in posting new breach reports on its public portal.
Prior Incident
This is not Woodfords Family Services’ first ransomware attack. On June 19, 2023, the organization reported unauthorized access to the personal information of 17,285 individuals, including the PHI of 6,691 individuals.
