Ascension Health Nonprofit Hospital System Breach (2023): Patient Medical Diagnoses & SSN Exposed

About Ascension Healthcare

Ascension Healthcare, also known as Ascension Health, is one of the largest nonprofit Catholic health systems in the United States. Headquartered in St. Louis, Missouri, the organization operates approximately 142 hospitals across sixteen states and the District of Columbia, alongside a wide network of senior-living facilities, physician practices, and ambulatory care sites. Ascension employs more than 142,000 staff and reported total revenue of approximately \$28.3 billion in fiscal 2023. As a HIPAA-regulated health system at substantial scale, Ascension maintains comprehensive protected health information across hospital, ambulatory, and home-care operations, including patient identity, insurance, billing, diagnostic, treatment, and prescription records.

Why They Hold Your Data

Large nonprofit health systems collect patient identity, contact, insurance, billing, scheduling, and clinical records across hospitals, clinics, and administrative systems.

Recent Developments

The 2023 MOVEit-related disclosure was followed by two further major incidents at Ascension. In May 2024, Ascension was directly hit by a Black Basta ransomware attack that began when an employee downloaded a malicious file, ultimately affecting approximately 5.6 million patients and forcing extended outages of clinical systems across the network. The system reported a \$1.1 billion net loss for fiscal 2024 due in part to the attack. In April 2025, Ascension disclosed a separate incident at a former business partner involving the late-2024 Cl0p exploitation of Cleo file-transfer software, ultimately affecting approximately 437,000 additional patients. Multiple class-action lawsuits and a continuing federal Office for Civil Rights review remain active as of 2026.

Data Points Exposed

Breach Impact

Ascension faces substantial cumulative institutional exposure, with three major breach events disclosed between 2023 and 2025 affecting more than six million patients in total. Federal HIPAA notification obligations, an active Office for Civil Rights review, multistate attorney-general filings, and class-action litigation pipelines are all underway. The 2024 Black Basta attack imposed direct operational costs through extended clinical-system outages, contributing to the system's reported fiscal-year net loss of \$1.1 billion. Vendor-pathway and supply-chain risks have prompted ongoing review of Ascension's third-party governance functions. The reputational impact is national in scope given Ascension's scale and the public discussion of patient-care disruptions during the May 2024 outage.

Exploitation & Downstream Threats

• Identity theft and synthetic identity construction using government-issued IDs | • SIM swap attacks where phone numbers are present | • Doxxing risk from physical address exposure | • Medical identity fraud or insurance abuse using health data

What You Should Do

1. Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
2. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
3. Watch for medical-benefit fraud and health-themed phishing that references real provider relationships.
4. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
5. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).