Cyberattack on Clinical Registry Solutions Exposes Patient and Employee Data Brooklyn-based healthcare data management firm Clinical Registry Solutions (CRS) disclosed a data breach affecting patient information it maintained for St. Mary’s Medical Center, a Dignity Health hospital. CRS, which provides clinical data abstraction and registry support to healthcare providers, detected suspicious activity on its network on April 9, 2026, prompting an immediate investigation. The company confirmed that an unauthorized party accessed its systems on the same day, acquiring files containing patient data from St. Mary’s Medical Center. According to CRS’s notification, the exposed information included names, medical record numbers, and procedure dates classified as both personally identifiable information (PII) and protected health information (PHI). The company clarified that Social Security numbers, diagnoses, and treatment plans were not part of the compromised patient data. However, on May 6, 2026, the Akira ransomware group claimed responsibility for the attack via a Tor-based dark web posting, asserting it had exfiltrated 41 GB of data from CRS. The group’s claims extended beyond patient records, alleging the theft of employee PII including passports, driver’s licenses, and Social Security numbers as well as corporate documents, financial records, payment details, contracts, and non-disclosure agreements. The discrepancy between CRS’s disclosure and Akira’s claims remains unresolved. CRS reported the breach to the California Attorney General and stated it found no evidence of misuse of the exposed data for fraud or identity theft. The company engaged Cyberscout (a TransUnion subsidiary) to manage breach notifications, sending letters to affected individuals with guidance on fraud alerts, credit freezes, and credit monitoring. A dedicated call center was established for inquiries, operating Monday through Friday from 8:00 a.m. to 8:00 p.m. EST. The incident highlights the risks of third-party vendor breaches in healthcare, where sensitive data is often shared across multiple entities. While CRS has taken steps to mitigate the fallout, the full scope of the exposure particularly regarding employee and corporate records remains under scrutiny.

An unauthorized third party accessed the personal identifying information (PII) and protected health information (PHI) of patients at Dignity Health’s St. Rose Dominican Hospital (Rosa de Lima Campus). The compromised data included names, contact details, Social Security numbers, dates of birth, clinical/diagnosis records, medical account numbers, and service locations. The breach, disclosed around March 2024, led to a $675,000 class-action settlement to cover identity theft risks, fraudulent transactions, falsified tax returns, and unauthorized medical claims. Patients were offered credit monitoring, medical identity-theft protection, and reimbursements up to $2,500 for extraordinary losses. The incident exposed victims to financial fraud, medical identity theft, and reputational harm, with potential long-term consequences for affected individuals. The breach was attributed to a cybersecurity failure allowing external access to sensitive records.

The California Office of the Attorney General reported a data breach involving Dignity Health - Mercy San Juan Medical Center on November 13, 2017. From September 8 to 12, 2017, a software error in the Employee Self Service system exposed employee names, employee ID numbers, and Social Security Numbers to other internal staff. The total number of individuals affected is unknown.

Dominican Hospital, part of Dignity Health, accedentially suffered from a data breach incident in August 2016. The attack compromised the name, account number, admission date, length of stay, total charges, unit they were seen in, room number they were seen in, and insurance carrier name. The health plan that received the transmission has been cooperating with the hospital and expected to provide an attestation that the errant data was destroyed. Dominican Hospital took action and provided traning sessions to their staff and took disciplinary action.

On July 28, 2016, Dominican Hospital, a healthcare facility under the jurisdiction of the California Office of the Attorney General, suffered a data breach involving the unauthorized transmission of a Microsoft Excel workbook via secured email. The file was sent to a local health plan but inadvertently included patient information for individuals not affiliated with the plan. The exposed data comprised sensitive details such as names, account numbers, and medical records, though Social Security numbers were not compromised. The breach raised concerns over patient privacy violations and potential misuse of medical data, which could lead to identity theft, targeted phishing, or fraudulent medical claims. While the exact number of affected individuals remains undisclosed (marked as 'UNKN'), the incident underscored vulnerabilities in data-sharing protocols between healthcare providers and third-party entities. The exposure of medical information—a highly regulated and sensitive data category—poses long-term risks, including reputational damage to the hospital and erosion of patient trust. Regulatory scrutiny under HIPAA (Health Insurance Portability and Accountability Act) likely followed, given the nature of the compromised data.

On June 9, 2016, Dignity Health reported a data breach involving patient information accessed inappropriately by a case manager employed by their business partner, naviHealth, from June 2015 to May 2016. The breach potentially affected various personal and clinical information of patients, including names, social security numbers, and health insurance details. Dignity Health is offering 12 months of free credit monitoring to affected individuals.