The North Dakota Department of Health and Human Services (HHS) is providing notice of a security incident that involves protected health information (PHI) of certain Developmental Disabilities service recipients.
On July 21, 2026, the North Dakota Information Technology Department (NDIT) identified a phishing email attack targeting HHS. NDIT acted immediately to stop the phishing email attack. On July 22, 2026, NDIT detected unusual sign in activity related to the incident. Upon investigation, NDIT determined that three employees within Developmental Disabilities had interacted with the phishing email, which allowed an unauthorized third party to gain access to their email accounts.
NDIT promptly secured the affected email accounts to prevent any further unauthorized access. HHS conducted a thorough review to determine the extent of PHI accessed and to identify affected individuals. The review was completed on August 14, 2026.
The PHI involved in the unauthorized access varies by individual and may include name, contact information, date of birth, age, Developmental Disabilities service information, name of health plan and identification number, medical information, and guardian information.
HHS is in the process of providing written notification to affected individuals. Affected individuals are encouraged to watch for incidents of identity theft or fraud by reviewing financial and medical accounts, including statements, credit reports, medical records, and explanation of benefits, for anything unusual. Affected individuals are reminded to be cautious of unexpected communications, including emails, text messages or phone calls, requesting personal information. Affected individuals may want to place a free fraud alert with one of the three major credit reporting companies:
- Equifax: (877) 478-7625 or www.equifax.com
- Experian: (888) 397-3742 or www.experian.com
- TransUnion: (800) 680-7289 or www.transunion.com
Information about preventing or reporting identity theft, can be obtained from the North Dakota Attorney General’s website at attorneygeneral.nd.gov and the Federal Trade Commission’s website at www.ftc.gov.
Affected individuals may contact Kristen Vander Vorst, Developmental Disabilities Field Services Administrator, at (800) 755-8529, Monday through Friday, between the hours of 8:00 a.m. and 5:00 p.m. CT with any questions or related concerns.
HHS takes the privacy and security of PHI seriously. We are working closely with NDIT to strengthen safeguards, enhance cybersecurity awareness training, and prevent similar incidents in the future.
Consistent with federal and state regulatory requirements, HHS has notified the U.S. Department of Health and Human Services Office for Civil Rights and the North Dakota Attorney General’s Office of the security incident.