Skip to Main Content

CommonSpirit Health Provides Cyberattack Notification of Data Breach

CommonSpirit Health and its affiliated entities (“CommonSpirit”) take the protection and proper use of personal information very seriously. Regrettably, CommonSpirit experienced a ransomware event that impacted some personal information. While CommonSpirit has no evidence of misuse of the personal information as a result of the incident, this notice is to explain the incident, our response to it, and steps one can take to protect personal information.  

CommonSpirit Health is the parent organization to Catholic Health Initiatives and Dignity Health facilities. CommonSpirit Health also is or has been associated with Centura Health and MercyOne (Iowa).  Not all CommonSpirit Health locations were involved in this incident. A list of locations whose data may have been involved can be found here

What happened?

On October 2, 2022, CommonSpirit detected a ransomware attack on its IT network. CommonSpirit immediately took steps to secure the network, which included proactively taking some systems offline, and began an investigation with the assistance of an external forensics vendor. The investigation determined that an unauthorized third party gained access to the network between September 16, 2022 and October 3, 2022. While the unauthorized third party did not retrieve data directly from CommonSpirit’s Electronic Medical Records systems, during that time, the unauthorized third party obtained copies of some of the data on our systems, including files from two file share servers that contained some individuals’ information. CommonSpirit had used the data on the file share servers in performing various operational functions, and some of the data dates back several years. With respect to the data on the file share servers, determining what and whose data was impacted has required a detailed and time-consuming review of each individual file on each file server to identify the specific individuals whose information may have been impacted, and the type of information associated with each such individual. The initial phase of this part of the investigation was completed on February 21, 2023.  Once this component of the review concluded, we worked to identify, when possible, the current and past CommonSpirit location(s) associated with the data.   We then worked to identify accurate address information to provide notice to potentially affected individuals and only recently completed these efforts. 

What information was involved.

The individuals included in this notification are those whose information was identified on the file share servers.

The information in the files included demographics such as name, address, date of birth, phone number(s), email address, as well as medical information such as dates of service, medical record number, healthcare provider’s name, diagnosis/treatment information, medical billing/claims information, patient’s facility associated account/encounter number, and health insurance information. For a small number of individuals, Social Security Number was also involved.

What we are doing.

Upon discovering the ransomware attack, CommonSpirit quickly mobilized to protect its systems, contain the incident, begin an investigation, and maintain continuity of care.  In addition, CommonSpirit notified law enforcement.  Once secured, systems were returned to the network with additional security and monitoring tools.  CommonSpirit began notifying individuals impacted by the file share server data by US. Mail on April 6, 2023.

What you can do.

Though CommonSpirit has no evidence that the information has been misused as a result of this event, it is always prudent to review health care statements for accuracy and report any services or charges that were not incurred to the provider or insurance carrier.

For more information.

If you need more information about this event, we have retained Kroll, a trusted third party partner, to manage a call center that can answer specific questions about this event. To contact Kroll, please call 1-866-869-0312, Monday through Friday from 8:00 a.m. to 5:30 p.m. Central Time excluding U.S. holidays. 

Media inquiries may be sent to:    [email protected].

We apologize for any concern this may cause. Protecting your information is important to us. We trust that this notification and additional resource information demonstrates our continued commitment to your security and satisfaction.

 

Frequently Asked Questions (FAQs)

On October 2, 2022, CommonSpirit detected activity on our IT network that we later determined was ransomware. We immediately took steps to secure the network, which included proactively taking certain systems offline, and began an investigation with the assistance of leading external cybersecurity specialists. The investigation determined that an unauthorized third party gained access to certain portions of our network between September 16, 2022 and October 3, 2022. During that time, the unauthorized third party may have gained access to certain files, including files that contained personal information. CommonSpirit has no evidence that any personal information has been misused as a result of the incident.

We are notifying individuals whose personal information was identified in files associated with services provided by Franciscan Medical Group and/or Franciscan Health in Washington state. Letters to affected individuals were sent via U.S. mail, beginning on December 1, 2022.


CommonSpirit Health and its affiliated entities (“CommonSpirit”) take the protection and proper use of personal information very seriously. Regrettably, CommonSpirit recently experienced a ransomware event that impacted some personal information. 

What happened?

On October 2, 2022, CommonSpirit detected activity on its IT network that was later determined to be ransomware. CommonSpirit immediately took steps to secure the network, which included proactively taking certain systems offline, and began an investigation with the assistance of leading external cybersecurity specialists. The investigation determined that an unauthorized third party gained access to certain portions of CommonSpirit’s network between September 16, 2022 and October 3, 2022. During that time, the unauthorized third party may have gained access to certain files, including files that contained personal information. While a review of these files is ongoing, CommonSpirit identified that some of this data included personal information for individuals who may have received services in the past, or family members or caregivers of those individuals, from Franciscan Medical Group and/or Franciscan Health in Washington state. Franciscan Health includes St. Michael Medical Center (formerly Harrison Hospital), St. Anne Hospital (formerly Highline Hospital), St. Anthony Hospital, St. Clare Hospital, St. Elizabeth Hospital, St. Francis Hospital, and St. Joseph Medical Center. Those facilities are now known collectively as Virginia Mason Franciscan Health, which is an affiliated entity of CommonSpirit. 

What information was involved?

While the review of the files is ongoing, we identified that the information in some of the files related to patients, family members of patients, or caregivers of patients and included: Name, address, phone number(s), date of birth, and a unique ID used only internally by the organization (not the Medical Record Number or insurance ID). CommonSpirit has no evidence that any personal information has been misused as a result of the incident. 

What we are doing?

Upon discovering the ransomware attack, CommonSpirit quickly mobilized to protect its systems, contain the incident, begin an investigation, and maintain continuity of care.  In addition, CommonSpirit notified law enforcement and is supporting their ongoing investigation.  Once secured, systems were returned to the network with additional security and monitoring tools.  

Actions you may wish to take.

Though CommonSpirit has no evidence that any personal information has been misused as a result of the incident, it is always prudent for patients to review health care statements for accuracy and report any services or charges that were not incurred to the provider or insurance carrier.

For more information.

CommonSpirit has set up a special call center to answer questions about the event. You can call our special our call center at (855) 504-2738, Monday through Friday from 7:00 a.m. to 4:30 p.m. Pacific Time, excluding U.S. holidays.  

We apologize for any concern this may cause. Protecting personal information is important to us.

On October 2, 2022, CommonSpirit detected activity on our IT network that we later determined was ransomware. We immediately took steps to secure the network, which included proactively taking certain systems offline, and began an investigation with the assistance of leading external cybersecurity specialists. The investigation determined that an unauthorized third party gained access to certain portions of our network between September 16, 2022 and October 3, 2022. During that time, the unauthorized third party may have gained access to certain files, including files that contained personal information. CommonSpirit has no evidence that any personal information has been misused as a result of the incident.

On December 15, 2022. CommonSpirit notified one of its joint ventures. St Luke’s Diagnostic Cath Lab, Diagnostic Heart Center (“DHC”), located in Houston, Texas, that the unauthorized third party accessed a file that contained the personal information of some patients, patient guarantors, and some staff or credentialed practitioners of DHC.  

At the direction of DHC, CommonSpirit is notifying individuals whose personal information was identified in this file. Letters to affected individuals were sent via U.S. mail, beginning on February 9, 2023.

CommonSpirit has established a special call center with a trusted third party partner, Kroll, to answer specific questions from impacted individuals about this event. To contact this special call center, please call 1-866-674-3010, Monday through Friday from 8:00 a.m. to 5:30 p.m. Central Time excluding U.S. holidays.