MicroCode Software Services Discloses Ransomware Breach Affecting CommonSpirit Health Data MicroCode Software Services Inc., an IT vendor for CommonSpirit Health, reported a data breach stemming from a ransomware attack that exposed sensitive medical malpractice insurance records. The incident was disclosed to the Washington Attorney General on July 30, 2026, with 4,096 Washington residents confirmed as affected. The breach occurred after unauthorized access to MicroCode’s server hosting CommonSpirit Health’s database was detected between January 19 and April 14, 2026. A forensic investigation revealed that the ransomware attack on April 14, 2026, compromised the system, prompting MicroCode to review the impacted data. By July 1, 2026, the company confirmed that personally identifiable information (PII), including names and dates of birth, was exposed. However, Social Security numbers, financial account details, and other highly sensitive data were not accessed. In response, MicroCode engaged Kroll, a third-party firm, to operate a call center for affected individuals. The company also mailed notification letters with resources for credit monitoring and fraud protection. The breach highlights ongoing risks in third-party vendor security within the healthcare sector.

CommonSpirit Health Vendor Breach Exposes Data of Nearly 20,000 Washington Residents A ransomware attack on Pinnacle Holdings, LTD, a healthcare consulting vendor, has led to the exposure of sensitive personal data linked to CommonSpirit Health, one of the largest nonprofit health systems in the U.S. The incident, discovered on November 25, 2024, involved unauthorized access to Pinnacle’s network between November 11 and November 25, 2024, during which a threat actor copied personally identifiable information (PII). Pinnacle, which provides services to Northgauge Healthcare Advisors a contractor for CommonSpirit Health isolated its systems and launched an investigation following the breach. However, delays in notification meant that Northgauge was only informed in November 2025, with impacted individuals not identified until January 30, 2026. CommonSpirit Health was notified of affected Washington residents on February 2, 2026. The exposed data includes names, full dates of birth, medical information, and other unspecified details. The breach was reported to the Washington Attorney General, with 19,027 state residents confirmed as affected. CommonSpirit Health has since posted a notice on its website regarding the incident. The law firm Shamis & Gentile P.A. is investigating potential compensation for those impacted, citing eligibility for damages related to the exposure of personal data. The breach highlights risks associated with third-party vendors in healthcare cybersecurity.

CommonSpirit, the second-largest nonprofit hospital chain in the U.S., suffered a cybersecurity incident that disrupted medical services across the country. The attack caused certain IT systems including electronic health records and other systems to go offline which resulted in rescheduling some patient appointments.

CommonSpirit Health is now facing a class action lawsuit because of the cyberattacks that it faced in 2022. The lawsuit was initiated because the attacks impacted facilities across one of the largest nonprofit healthcare systems in the US. Back in the last year, CommonSpirit began reporting IT outages, EHR downtime, and appointment cancellations in early October, later confirming that these disruptions were caused by attacks. The latest lawsuit alleges that CommonSpirit lost control of highly sensitive information as a result of the breach and suggested that the health system has not been forthcoming about the breach. It was also alleged that the number of actual victims of the Data Breach may be much higher to approx twenty million individuals. The plaintiffs are seeking reimbursement for out-of-pocket costs, credit monitoring services, and improvements to CommonSpirit’s data security systems.