Mankato Clinic (United States) notified the Indiana Attorney General of a data breach on 16 October 2026. It affected 21,986 people.
People affected
21,986people
Reported
16 October 2026Official notice
Time to tell
65 daysfrom 12 August 2026 · the median is 147
What was exposed
The register’s list does not say what was exposed; the notice it links to (under Sources) usually does.
Before the notice: the ransomware gang Chaos named Mankato Clinic on its leak site on 10 September 2026, 36 days before this was reported. Matched by the organisation’s name: the notice itself does not say who the attacker was.
Mankato Clinic (United States) notified the Indiana Attorney General of a data breach on 16 October 2026. It affected 21,986 people. The sources do not say how it happened.
What data was exposed in the Mankato Clinic breach?
The notices and reports so far do not say what was exposed. This page is updated when they do.
How do I know if I was affected?
Organisations normally tell the people whose data was involved, by letter or email, and that notice says what of yours was in it. We cannot look up individual people. If you got a notice, check that it is real, then follow the steps on this page.
Is there a Mankato Clinic data breach settlement?
No settlement open for claims is on record for Mankato Clinic as of 15 November 2026. A settlement usually comes a year or more after a breach, if a court approves one. Every open settlement is listed with its deadline.
Is a letter, email or text about the Mankato Clinic breach real or a scam?
A real notice names the breach, says what data was involved and never asks for a password, a code or a payment. Criminals often send fake notices after a breach is in the news. Do not use links or phone numbers in the message: go to Mankato Clinic’s own site, or check the letter here.
Privacy Unpacked