St. Anthony Healthcare Data Breach Exposes Sensitive Patient Information St. Anthony, a healthcare provider, recently disclosed a data breach that may have compromised sensitive personal and medical information. The incident came to light in late August 2024 when the organization detected suspicious activity within its network systems. An investigation confirmed that an unauthorized third party accessed or acquired protected data between August 14 and August 28, 2024. The exposed information varies by individual but includes: - Personal identifiers: Names, Social Security numbers, addresses, dates of birth, driver’s license numbers, and other government-issued IDs. - Financial data: Payment card details and financial account information. - Medical records: Diagnoses, treatment details, prescription information, medical device serial numbers, biometric data, and health insurance details (including policy and Medicare/Medicaid IDs). St. Anthony has posted a breach notice on its website and is mailing notifications to affected individuals. For Massachusetts residents, the notices include a breakdown of the compromised data and 24 months of complimentary credit monitoring services. The full breach notice is available on St. Anthony’s website.

Saint Anthony Hospital, an independent nonprofit hospital in Chicago, experienced a data breach in February 2025 when unauthorized access to employee email accounts exposed sensitive personally identifiable information (PII) and protected health information (PHI) of 6,679 patients and employees. The compromised data included full names, addresses, dates of birth, Social Security numbers, telephone numbers, dates of service, and medical records. The breach was discovered on February 6, 2025, but was only disclosed to the U.S. Department of Health and Human Services (HHS) in September 2025, indicating a prolonged exposure period. The hospital engaged third-party cybersecurity experts and notified law enforcement, but the delay in public disclosure raises concerns about response efficiency. Affected individuals face risks of identity theft, financial fraud, and medical fraud, with potential long-term consequences. A class-action lawsuit is underway, offering compensation for victims. The incident underscores vulnerabilities in healthcare cybersecurity, particularly regarding email account security and timely breach detection, while also highlighting the broader implications of PHI exposure in a sector already targeted by cybercriminals.