Saint Luke's Foundation
Disclosed Aug 20, 20206 years ago360,212 affectedConfirmed
The covered entity (CE), Saint Luke’s Foundation, reported that its business associate (BA), Blackbaud, Inc., experienced a ransomware attack affecting the electronic protected health information (ePHI) of approximately 360,212 of its patients. The ePHI involved included names, addresses, dates of birth, telephone numbers, email addresses, and treatment information. The CE notified HHS, affected individuals, the media, and provided substitute notice.
What is known
| People affected | 360,212 (as reported to HHS) |
|---|---|
| Disclosed | Aug 20, 2020 |
| Happened | Feb 7, 2020 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Nonprofit · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Saint Luke's Foundationoag.ca.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Saint Luke's Foundation (Healthcare Provider, MO)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Aug 20, 2020 | |
| HHS archivetotal | Aug 20, 2020 | 360,212 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 360212 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Saint Luke’s Foundation, reported that its business associate (BA), Blackbaud, Inc., experienced a ransomware attack affecting the electronic protected health information (ePHI) of approximately 360,212 of its patie · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.