CommonSpirit Health Vendor Breach Exposes Data of Nearly 20,000 Washington Residents A ransomware attack on Pinnacle Holdings, LTD, a healthcare consulting vendor, has led to the exposure of sensitive personal data linked to CommonSpirit Health, one of the largest nonprofit health systems in the U.S. The incident, discovered on November 25, 2024, involved unauthorized access to Pinnacle’s network between November 11 and November 25, 2024, during which a threat actor copied personally identifiable information (PII). Pinnacle, which provides services to Northgauge Healthcare Advisors a contractor for CommonSpirit Health isolated its systems and launched an investigation following the breach. However, delays in notification meant that Northgauge was only informed in November 2025, with impacted individuals not identified until January 30, 2026. CommonSpirit Health was notified of affected Washington residents on February 2, 2026. The exposed data includes names, full dates of birth, medical information, and other unspecified details. The breach was reported to the Washington Attorney General, with 19,027 state residents confirmed as affected. CommonSpirit Health has since posted a notice on its website regarding the incident. The law firm Shamis & Gentile P.A. is investigating potential compensation for those impacted, citing eligibility for damages related to the exposure of personal data. The breach highlights risks associated with third-party vendors in healthcare cybersecurity.

CommonSpirit, the second-largest nonprofit hospital chain in the U.S., suffered a cybersecurity incident that disrupted medical services across the country. The attack caused certain IT systems including electronic health records and other systems to go offline which resulted in rescheduling some patient appointments.

CommonSpirit Health is now facing a class action lawsuit because of the cyberattacks that it faced in 2022. The lawsuit was initiated because the attacks impacted facilities across one of the largest nonprofit healthcare systems in the US. Back in the last year, CommonSpirit began reporting IT outages, EHR downtime, and appointment cancellations in early October, later confirming that these disruptions were caused by attacks. The latest lawsuit alleges that CommonSpirit lost control of highly sensitive information as a result of the breach and suggested that the health system has not been forthcoming about the breach. It was also alleged that the number of actual victims of the Data Breach may be much higher to approx twenty million individuals. The plaintiffs are seeking reimbursement for out-of-pocket costs, credit monitoring services, and improvements to CommonSpirit’s data security systems.