Trinity Health

Disclosed Sep 14, 20203,320,726 affectedConfirmed

The business associate (BA), Trinity Health, reported that it was the victim of a hacking attack affecting the protected health information (PHI) of 586,869 individuals. The PHI involved included names, addresses, dates of birth, Social Security numbers, claims and financial information, diagnoses, lab results, and medications. The BA notified HHS, affected individuals, the media, and provided substitute notice. In response to the breach, the BA provided complimentary credit monitoring services and implemented additional physical, administrative, and technical safeguards. OCR provided the BA with technical assistance regarding its HIPAA Security Rule obligations.

What is known

People affected	3,320,726 (as reported to HHS)
Disclosed	Sep 14, 2020
Happened	Jan 20, 2021
Attack	Hacking
Data exposed	NamesHealth
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Trinity Health

Official noticein.gov

Indiana Attorney General 2020 data breach report: Trinity Health

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): Trinity Health (Business Associate, MI)

Notices filed

Residents of INSep 14, 2020

Indiana AG67 people

TotalSep 14, 2020

HHS archive3,320,726 people

Residents of CAOct 23, 2020

California AGCount not stated

Residents of CAApr 5, 2021

California AGCount not stated

TotalApr 5, 2021

HHS archive586,869 people

Other breaches at Trinity Health

Insider breachInsider exposed names and health records. Reported to the HHS OCR.33K affectedHealthcareUSMar 13 Hacking breachHacking exposed names and health records. Reported to the HHS archive.47K affectedHealthcareUSAug 29, 2022

History of this record

records2026-09-25

586869 to 3320726by backfillSource

attack2026-09-25

unknown to hackingby backfillSource

data_types2026-09-25

[] to ["names","health"]by backfillSource

records_basis2026-09-25

organization to hhsby backfillSource

records2026-09-25

6288 to 586869by backfillSource

summary2026-09-25

empty to The business associate (BA), Trinity Health, reported that it was the victim of a hacking attack affecting the protected health information (PHI) of 586,869 individuals. The PHI involved included names, addresses, dates of birth, Social Secby backfillSource

records_basis2026-09-25

empty to organizationby backfillSource

records2026-09-25

empty to 6288by backfillSource

disclosed2026-09-25

2020-10-23 to 2020-09-14by backfillSource

disclosed2026-09-25

2021-04-05 to 2020-10-23by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Trinity Health