Corewell Health Data Breach Exposes Personal and Medical Data of 19,000 Patients A data breach at Pinnacle Holdings, LTD a former healthcare consulting provider for Michigan-based Corewell Health has compromised the sensitive information of approximately 19,000 Corewell Health patients. The incident occurred on November 25, 2024, when Pinnacle Holdings detected a "network disruption" affecting certain systems. During its investigation, the Colorado-based firm determined that an unauthorized individual may have accessed patient data. Corewell Health was notified of the breach in early 2024 and promptly launched a review to identify affected individuals. Exposed information includes names, phone numbers, Social Security numbers, driver’s license numbers, dates of birth, health insurance details, prescription information, and service dates. Pinnacle Holdings stated it has since implemented additional safeguards to prevent future incidents and has begun notifying impacted individuals. As part of the response, affected patients are being offered free credit monitoring and identity protection services. The firm reported no evidence of fraudulent activity resulting from the breach. Individuals seeking more information can contact Pinnacle Holdings at 866-686-2607.

CommonSpirit Health Vendor Breach Exposes Data of Nearly 20,000 Washington Residents A ransomware attack on Pinnacle Holdings, LTD, a healthcare consulting vendor, has led to the exposure of sensitive personal data linked to CommonSpirit Health, one of the largest nonprofit health systems in the U.S. The incident, discovered on November 25, 2024, involved unauthorized access to Pinnacle’s network between November 11 and November 25, 2024, during which a threat actor copied personally identifiable information (PII). Pinnacle, which provides services to Northgauge Healthcare Advisors a contractor for CommonSpirit Health isolated its systems and launched an investigation following the breach. However, delays in notification meant that Northgauge was only informed in November 2025, with impacted individuals not identified until January 30, 2026. CommonSpirit Health was notified of affected Washington residents on February 2, 2026. The exposed data includes names, full dates of birth, medical information, and other unspecified details. The breach was reported to the Washington Attorney General, with 19,027 state residents confirmed as affected. CommonSpirit Health has since posted a notice on its website regarding the incident. The law firm Shamis & Gentile P.A. is investigating potential compensation for those impacted, citing eligibility for damages related to the exposure of personal data. The breach highlights risks associated with third-party vendors in healthcare cybersecurity.