Providence
Disclosed Jan 16, 20268 months ago22,701 affectedConfirmed
The covered entity (CE), Providence, reported that its business associate (BA) experienced a cybersecurity incident that compromised the protected health information (PHI) of 22,701 individuals. The PHI involved included clinical and demographic and treatment information. The CE notified HHS, the media, and provided substitute notice; and the BA notified individuals on the CE’s behalf. In response to the breach, affected individuals were provided with complimentary credit monitoring services.
What is known
| People affected | 22,701 (as reported to HHS) |
|---|---|
| Disclosed | Jan 16, 2026 |
| Discovered | Feb 11, 2026 |
| Happened | Aug 30, 2024 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Providenceoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Providenceatg.wa.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Providence (Healthcare Provider, WA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Jan 16 | 22,701 |
| California AGresidents of CA | Apr 16 | |
| Washington AGresidents of WA | Apr 16 | 838 |
History of this record
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 22701 · backfill source
- 2026-09-25 · disclosed: 2026-04-16 to 2026-01-16 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Providence, reported that its business associate (BA) experienced a cybersecurity incident that compromised the protected health information (PHI) of 22,701 individuals. The PHI involved included clinical and demogr · backfill source
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2026-02-11 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.