Notice of Data Security Incident

Morrison, IL – November 22, 2023 – Morrison Community Hospital (“MCH”) notified certain current
and former patients that their personal information may have been accessed as part of cybersecurity
incident. MCH takes the privacy and security of information in its possession very seriously and sincerely
apologizes for any inconvenience this incident may cause. This notice is intended to alert potentially
impacted individuals of the incident, steps we are taking in response, and resources available to assist and
protect individuals.

What Happened September 24, 2023, MCH experienced a network security incident that involved an
unauthorized party gaining access to our network environment. Upon detecting the incident, we
immediately shut off all access to the network and engaged a specialized third-party forensic incident
response firm to assist with securing the network environment and investigating the extent of unauthorized activity. MCH’s network has been secured. MCH is providing written notice to all impacted individuals. MCH has no reason to believe that any individual’s information has been misused as a result of this event. As of this writing, MCH has not received any reports of misuse of information and/or related identity theft since the date the incident was discovered (September 24, 2023 to present).

What We Are Doing Data security is one of our highest priorities. Upon detecting this incident we moved
quickly to initiate a response, which included conducting an investigation with the assistance of IT
specialists and confirming the security of our network environment. We have also reviewed and enhanced
our technical safeguards to prevent a similar incident.

The notification letter to the potentially impacted individuals includes steps that they can take to protect
their information. In order to address any concerns and mitigate any exposure or risk of harm following this incident, MCH has arranged for complimentary credit monitoring services and identity theft protection services to all potentially impacted individuals at no cost to them for a period of twelve months. MCH recommends that individuals enroll in the services provided and follow the recommendations contained within the notification letter to ensure their information is protected. For More Information For individuals seeking more information or questions about this incident, please
call 1-844-881-3407, Monday through Friday, 8:00 am – 8:00 pm ET, excluding holidays.

Thank you for entrusting MCH with your healthcare needs. We value the security of the personal data that we maintain, and understand the frustration, concern, and inconvenience that this incident may have caused. We look forward to continuing to provide high quality care to you, your family, and the Morrison community.