The investigation has found that an unauthorized actor gained access to BHCC's network before deploying ransomware. The investigation was also able to confirm that a limited amount of data was copied from BHCC's network. Accordingly, BHCC reviewed the relevant data to determine whether any personal information was present so it could notify individuals as appropriate. There is currently no indication that the unauthorized actor has misused any information for identity theft or fraud in connection with the breach.

BHCC's investigation determined that the following general categories of information may have been involved in the Incident but are not relevant to every individual: name, date of birth, Social Security Number, driver's license number, state identification number, U.S. alien identification number, passport number, financial account number in combination with routing number or code, credit/debit card number, username and password, medical information and health insurance information.