CommonSpirit Health

Disclosed Oct 5, 2022633,031 affectedConfirmed

Ransomware attack on CommonSpirit exposes data of 623,774 patients

CommonSpirit Health said attackers were in parts of its network between September 16 and October 3, 2022, disrupting electronic health records at many facilities. A filing with HHS put the number of affected patients at 623,774.

What is known

People affected	633,031 (as reported to HHS)
Disclosed	Oct 5, 2022
Discovered	Oct 2, 2022
Happened	Sep 16, 2022
Attack	Ransomware
Data exposed	NamesAddressesPhone numbersDates of birthOtherHealth
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticeatg.wa.gov

Washington Attorney General breach notice: CommonSpirit Health

Newstechcrunch.com

CommonSpirit Health says patient data was stolen during ransomware attack

The organizationcommonspirit.org

CommonSpirit Update

Official noticein.gov

Indiana Attorney General 2023 data breach report: CommonSpirit Health

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): CommonSpirit Health (Business Associate, IL)

Notices filed

TotalOct 5, 2022

Research623,774 people

Residents of WADec 1, 2022

Washington AG582,285 people

TotalDec 1, 2022

HHS archive633,031 people

Residents of INApr 6, 2023

Indiana AG6 people

Other breaches at CommonSpirit Health

Hacking breachHacking, data exposed not stated. Reported to the Washington AG.HealthcareUSFeb 25

History of this record

data_types2026-09-25

["names","addresses","phone","dob","other"] to ["names","addresses","phone","dob","other","health"]by backfillSource

records_basis2026-09-25

organization to hhsby backfillSource

records2026-09-25

623774 to 633031by backfillSource

source2026-09-25

empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/D-BYear-to-Date-Report-2023.pdfby backfillSource

data_types2026-09-25

[] to ["names","addresses","phone","dob","other"]by seedSource

records_basis2026-09-25

empty to organizationby seedSource

records2026-09-25

empty to 623774by seedSource

disclosed2026-09-25

2022-12-01 to 2022-10-05by seedSource

summary2026-09-25

empty to CommonSpirit Health said attackers were in parts of its network between September 16 and October 3, 2022, disrupting electronic health records at many facilities. A filing with HHS put the number of affected patients at 623,774.by seedSource

title2026-09-25

empty to Ransomware attack on CommonSpirit exposes data of 623,774 patientsby seedSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (Washington AG), confirmed by Washington AG. Record counts are as reported. Not legal advice.

Everything about CommonSpirit Health