Graceworks Lutheran Services

Disclosed Mar 26, 20236,737 affectedConfirmed

Graceworks Lutheran Services, the covered entity (CE), reported that it experienced a ransomware attack that affected the protected health information (PHI) of 6,737 individuals. The PHI involved included names, addresses, dates of birth, social security numbers, claims information, diagnoses/conditions, lab results, medications, and other treatment information. The CE notified HHS, affected individuals, the media, and posted substitute notice on its website. In response to the breach, the CE strengthened its administrative, technical, and security safeguards. OCR provided technical assistance regarding the HIPAA Rules.

What is known

People affected	6,737 (as reported to HHS)
Disclosed	Mar 26, 2023
Happened	Feb 28, 2023
Attack	Hacking
Data exposed	NamesHealth
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticein.gov

Indiana Attorney General 2023 data breach report: Graceworks Lutheran Services

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): Graceworks Lutheran Services (Healthcare Provider, OH)

Notices filed

Residents of INMar 26, 2023

Indiana AG831 people

TotalApr 19, 2023

HHS archive6,737 people

History of this record

sector2026-09-25

other to healthby backfillSource

attack2026-09-25

unknown to hackingby backfillSource

data_types2026-09-25

[] to ["names","health"]by backfillSource

records_basis2026-09-25

organization to hhsby backfillSource

records2026-09-25

4324 to 6737by backfillSource

summary2026-09-25

empty to Graceworks Lutheran Services, the covered entity (CE), reported that it experienced a ransomware attack that affected the protected health information (PHI) of 6,737 individuals. The PHI involved included names, addresses, dates of birth, sby backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.

Everything about Graceworks Lutheran Services