CommonSpirit Health
Disclosed Oct 5, 20223 years ago633,031 affectedConfirmed
Ransomware attack on CommonSpirit exposes data of 623,774 patients
CommonSpirit Health said attackers were in parts of its network between September 16 and October 3, 2022, disrupting electronic health records at many facilities. A filing with HHS put the number of affected patients at 623,774.
What is known
| People affected | 633,031 (as reported to HHS) |
|---|---|
| Disclosed | Oct 5, 2022 |
| Discovered | Oct 2, 2022 |
| Happened | Sep 16, 2022 |
| Attack | Ransomware |
| Data exposed | Names, Addresses, Phone numbers, Dates of birth, Other, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Washington Attorney General breach notice: CommonSpirit Healthatg.wa.gov · Official notice | Official notice |
| CommonSpirit Health says patient data was stolen during ransomware attacktechcrunch.com · News | News |
| CommonSpirit Updatecommonspirit.org · The organization | The organization |
| Indiana Attorney General 2023 data breach report: CommonSpirit Healthin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): CommonSpirit Health (Business Associate, IL)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Oct 5, 2022 | 623,774 |
| Washington AGresidents of WA | Dec 1, 2022 | 582,285 |
| HHS archivetotal | Dec 1, 2022 | 633,031 |
| Indiana AGresidents of IN | Apr 6, 2023 | 6 |
Other breaches at CommonSpirit Health
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Disclosed Feb 25, 2026Feb 257 months agoHacking | Feb 257 months ago | Hacking | Healthcare | Confirmed | Unknown |
History of this record
- 2026-09-25 · data_types: ["names","addresses","phone","dob","other"] to ["names","addresses","phone","dob","other","health"] · backfill source
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 623774 to 633031 · backfill source
- 2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/D-BYear-to-Date-Report-2023.pdf · backfill source
- 2026-09-25 · data_types: [] to ["names","addresses","phone","dob","other"] · seed source
- 2026-09-25 · records_basis: empty to organization · seed source
- 2026-09-25 · records: empty to 623774 · seed source
- 2026-09-25 · disclosed: 2022-12-01 to 2022-10-05 · seed source
- 2026-09-25 · summary: empty to CommonSpirit Health said attackers were in parts of its network between September 16 and October 3, 2022, disrupting electronic health records at many facilities. A filing with HHS put the number of affected patients at 623,774. · seed source
- 2026-09-25 · title: empty to Ransomware attack on CommonSpirit exposes data of 623,774 patients · seed source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Washington AG), confirmed by Washington AG. Record counts are as reported. Not legal advice.