“While the notice did not say how many individuals were affected, Norton Healthcare informed the Maine Attorney General’s Office that the attackers stole the personal information of 2.5 million individuals.”
Norton Healthcare caught the intrusion on May 9. BlackCat claimed it that same month and threatened to leak 4.7 terabytes. Norton took until mid-November to work out that Social Security numbers and health records were gone. Its own public notice left out the 2.5 million figure. You have to read a filing in Maine to learn how bad a Kentucky hospital breach was.