DataBreaches.Net

Menu
  • About
  • Breach Notification Laws
  • Privacy Policy
  • Transparency Report
Menu

CommonSpirit Health Provides Cyberattack Update and Notification of Data Breach Involving Virginia Mason Franciscan Health in Washington state

Posted on December 4, 2022 by Dissent

There was an update on December 1 to the CommonSpirit ransomware attack that DataBreaches has reported on multiple times already.

Press release:

On October 2, 2022, CommonSpirit detected activity on its IT network that was later determined to be ransomware. CommonSpirit immediately took steps to secure the network, which included proactively taking certain systems offline, and began an investigation with the assistance of leading external cybersecurity specialists. The investigation determined that an unauthorized third party gained access to certain portions of CommonSpirit’s network September 16, 2022 and October 3, 2022. During that time, the unauthorized third party may have gained access to certain files, including files that contained personal information. While a review of these files is ongoing, CommonSpirit identified that some of this data included personal information for individuals who may have received services in the past, or family members or care givers of those individuals, from Franciscan Medical Group and/or Franciscan Health in Washington state. Franciscan Health includes St. Michael Medical Center (formerly Harrison Hospital), St. Anne Hospital (formerly Highline Hospital), St. Anthony Hospital, St. Clare Hospital, St. Elizabeth Hospital, St. Francis Hospital, and St. Joseph Hospital. Those facilities are now known collectively as Virginia Mason Franciscan Health, which is an affiliated entity of CommonSpirit.

What information was involved?

While the review of the files is ongoing, we identified that the information in some of the files related to patients, family members of patients, or caregivers of patients and included: Name, address, phone number(s), date of birth, and a unique ID used only internally by the organization (not the Medical Record Number or insurance ID). CommonSpirit has no evidence that any personal information has been misused as a result of the incident.

What we are doing.

Upon discovering the ransomware attack, CommonSpirit quickly mobilized to protect its systems, contain the incident, begin an investigation, and maintain continuity of care.  In addition, CommonSpirit notified law enforcement and is supporting their ongoing investigation.  Once secured, systems were returned to the network with additional security and monitoring tools.

Actions you may wish to take.

Though CommonSpirit has no evidence that any personal information has been misused as a result of the incident, it is always prudent for patients to review health care statements for accuracy and report any services or charges that were not incurred to the provider or insurance carrier.

For more information.

CommonSpirit has established a dedicated website. For more information, please visit www.commonspirit.org or www.vmfh.org.

We apologize for any concern this may cause. Protecting personal information is important to us.

DataBreaches has written to CommonSpirit to urge them to be more transparent about this incident. Specifically, they have neither identified the threat actors nor disclosed whether they paid ransom.

Saying the attackers “may have” gained access to “certain files” is misleading, at best, if CommonSpirit negotiated with the attackers, got a list of all files extricated, and paid to have those files deleted from the attacker’s servers.

Did they?

CommonSpirits did not reply to DataBreaches’ inquiries.

Category: Breach IncidentsHealth DataMalwareU.S.

Post navigation

← Fr: Versailles hospital targeted by cyberattack
Little Rock School Board will meet to decide whether to negotiate settlement after data security breach →

Now more than ever

"Stand with Ukraine:" above raised hands. The illustration is in blue and yellow, the colors of Ukraine's flag.

Search

Browse by Categories

Recent Posts

  • Alabama Man Sentenced to 14 Months in Connection with Securities and Exchange Commission X Hack that Spiked Bitcoin Prices
  • Japan enacts new Active Cyberdefense Law allowing for offensive cyber operations
  • Breachforums Boss “Pompompurin” to Pay $700k in Healthcare Breach
  • HHS Office for Civil Rights Settles HIPAA Cybersecurity Investigation with Vision Upright MRI
  • Additional 12 Defendants Charged in RICO Conspiracy for over $263 Million Cryptocurrency Thefts, Money Laundering, Home Break-Ins
  • RIBridges firewall worked. But forensic report says hundreds of alarms went unnoticed by Deloitte.
  • Chinese Hackers Hit Drone Sector in Supply Chain Attacks
  • Coinbase says hackers bribed staff to steal customer data and are demanding $20 million ransom
  • $28 million in Texas’ cybersecurity funding for schools left unspent
  • Cybersecurity incident at Central Point School District 6

No, You Can’t Buy a Post or an Interview

This site does not accept sponsored posts or link-back arrangements. Inquiries about either are ignored.

And despite what some trolls may try to claim: DataBreaches has never accepted even one dime to interview or report on anyone. Nor will DataBreaches ever pay anyone for data or to interview them.

Want to Get Our RSS Feed?

Grab it here:

https://databreaches.net/feed/

RSS Recent Posts on PogoWasRight.org

  • Privacy enforcement under Andrew Ferguson’s FTC
  • “We would be less confidential than Google” – Proton threatens to quit Switzerland over new surveillance law
  • CFPB Quietly Kills Rule to Shield Americans From Data Brokers
  • South Korea fines Temu for data protection violations
  • The BR Privacy & Security Download: May 2025
  • License Plate Reader Company Flock Is Building a Massive People Lookup Tool, Leak Shows
  • FTC dismisses privacy concerns in Google breakup

Have a News Tip?

Email: Tips[at]DataBreaches.net

Signal: +1 516-776-7756

Contact Me

Email: info[at]databreaches.net

Mastodon: Infosec.Exchange/@PogoWasRight

Signal: +1 516-776-7756

DMCA Concern: dmca[at]databreaches.net
© 2009 – 2025 DataBreaches.net and DataBreaches LLC. All rights reserved.