CommonSpirit Health System Breach (2023): 11 Million Patient Records Including Medical Diagnoses Exposed

About Common Spirit

CommonSpirit Health is one of the largest nonprofit Catholic hospital networks in the United States, formed through the 2019 merger of Dignity Health and Catholic Health Initiatives. The system operates more than 140 hospitals and 1,000 care sites across 21 states, serving approximately 20 million patients annually. It is headquartered in Chicago and employs more than 150,000 people. Regional operations include CHI Health, Virginia Mason Franciscan Health, and dozens of other affiliated networks.

Why They Hold Your Data

Large nonprofit health systems collect patient identity, contact, insurance, billing, appointment, and clinical records across hospitals, clinics, and community-care operations.

Recent Developments

CommonSpirit has been managing financial and operational recovery across its large hospital portfolio. The system reported a $160 million estimated cost from a major 2022 ransomware attack — separate from the 2023 MOVEit incident in this database — related to business interruption and remediation. The organization has continued its mission-driven care delivery model while facing sustained pressure from the combined costs of two significant security incidents in consecutive years.

Data Points Exposed

Breach Impact

The 2023 incident reflects Cl0p's exploitation of a zero-day vulnerability in Progress Software's MOVEit Transfer platform at Nuance Communications, a transcription vendor serving CommonSpirit facilities. The attack window ran May 28–29, 2023. CommonSpirit posted an initial notice in September 2023 characterizing the exposure as limited — patient name, facility name, date and type of service, and for some patients a medical record number. A far broader dataset of 11.4 million records — including medical diagnoses and account balances — appeared on an underground marketplace in December 2024, contradicting the initial disclosure and drawing criticism that the scope had been understated. CommonSpirit offered one year of credit monitoring to affected individuals. Multiple class-action lawsuits were filed alleging negligence and delayed notification; some were dismissed for lack of standing at the district court level. CommonSpirit is a named defendant in the consolidated MOVEit multidistrict litigation in the District of Massachusetts.

Exploitation & Downstream Threats

• SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure | • Medical identity fraud or insurance abuse using health data

What You Should Do

1. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
2. Watch for medical-benefit fraud and health-themed phishing that references real provider relationships.
3. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
4. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).