Skip to Main Content

CommonSpirit Health Provides Cyberattack Update and Notification of Data Breach Involving Virginia Mason Franciscan Health in Washington state

CommonSpirit Health and its affiliated entities (“CommonSpirit”) take the protection and proper use of personal information very seriously. Regrettably, CommonSpirit recently experienced a ransomware event that impacted some personal information. 

What happened?

On October 2, 2022, CommonSpirit detected activity on its IT network that was later determined to be ransomware. CommonSpirit immediately took steps to secure the network, which included proactively taking certain systems offline, and began an investigation with the assistance of leading external cybersecurity specialists. The investigation determined that an unauthorized third party gained access to certain portions of CommonSpirit’s network between September 16, 2022 and October 3, 2022. During that time, the unauthorized third party may have gained access to certain files, including files that contained personal information. While a review of these files is ongoing, CommonSpirit identified that some of this data included personal information for individuals who may have received services in the past, or family members or care givers of those individuals, from Franciscan Medical Group and/or Franciscan Health in Washington state. Franciscan Health includes St. Michael Medical Center (formerly Harrison Hospital), St. Anne Hospital (formerly Highline Hospital), St. Anthony Hospital, St. Clare Hospital, St. Elizabeth Hospital, St. Francis Hospital, and St. Joseph Medical Center. Those facilities are now known collectively as Virginia Mason Franciscan Health, which is an affiliated entity of CommonSpirit. 

What information was involved?

While the review of the files is ongoing, we identified that the information in some of the files related to patients, family members of patients, or caregivers of patients and included: Name, address, phone number(s), date of birth, and a unique ID used only internally by the organization (not the Medical Record Number or insurance ID). CommonSpirit has no evidence that any personal information has been misused as a result of the incident. 

What we are doing?

Upon discovering the ransomware attack, CommonSpirit quickly mobilized to protect its systems, contain the incident, begin an investigation, and maintain continuity of care.  In addition, CommonSpirit notified law enforcement and is supporting their ongoing investigation.  Once secured, systems were returned to the network with additional security and monitoring tools.  

Actions you may wish to take.

Though CommonSpirit has no evidence that any personal information has been misused as a result of the incident, it is always prudent for patients to review health care statements for accuracy and report any services or charges that were not incurred to the provider or insurance carrier.

For more information.

CommonSpirit has set up a special call center to answer questions about the event. You can call our special call center at (855) 504-2738, Monday through Friday from 7:00 a.m. to 4:30 p.m. Pacific Time, excluding U.S. holidays, or visit our website at www.commonspirit.org.  

We apologize for any concern this may cause. Protecting personal information is important to us.


Frequently Asked Questions

What information was shared by CommonSpirit Health on December 1, 2022? 

On October 2, 2022, CommonSpirit detected activity on our IT network that we later determined was ransomware. We immediately took steps to secure the network, which included proactively taking certain systems offline, and began an investigation with the assistance of leading external cybersecurity specialists. The investigation determined that an unauthorized third party gained access to certain portions of our network between September 16, 2022 and October 3, 2022. During that time, the unauthorized third party may have gained access to certain files, including files that contained personal information. CommonSpirit has no evidence that any personal information has been misused as a result of the incident.

We are notifying individuals whose personal information was identified in files associated with services provided by Franciscan Medical Group and/or Franciscan Health in Washington state. Letters to affected individuals were sent via U.S. mail, beginning on December 1, 2022.

Who may be affected? How do I know if my personal information was affected?

While our review of the files that may be impacted is ongoing, we are notifying individuals whose personal information was identified in files associated with services provided by Franciscan Medical Group and/or Franciscan Health in Washington state. Letters to affected individuals were sent via U.S. mail, beginning on December 1, 2022.

What kind of information was affected in this incident?

For the letters that were mailed beginning on December 1, 2022, the information related to patients, family members of patients, or caregivers of patients included: Name, address, phone number(s), date of birth, and a unique ID used only internally by the organization (not the Medical Record Number or insurance ID). 

Which specific hospitals/locations were affected? 

While a review of the impacted files is ongoing, CommonSpirit identified that some of this data was associated with services provided in the past by Franciscan Medical Group and/or Franciscan Health in Washington state. The data in the files related to patients, family members or caregivers of patients that may have been seen at Washington state locations including:  St. Joseph Hospital (Tacoma), St. Francis Hospital (Federal Way), St. Elizabeth Hospital (Enumclaw), St. Clare Hospital (Lakewood), St. Anthony Hospital (Gig Harbor), St. Anne Hospital, formerly Highline Hospital (Burien), St. Michael Medical Center, formerly Harrison Hospital (Bremerton & Silverdale), and physician clinics associated with Franciscan Health. Franciscan Health is now part of Virginia Mason Franciscan Health.  

What is the status of the investigation? 

CommonSpirit is conducting a thorough investigation of the incident and our review of the files potentially accessed is ongoing.

What is CommonSpirit doing to prevent similar events from happening in the future?

CommonSpirit is conducting a thorough investigation of the incident. CommonSpirit notified law enforcement and is supporting their ongoing investigation. Upon discovery, CommonSpirit proactively took systems offline and isolated impacted systems for investigation. Once secured, systems were returned to the network with additional security and monitoring tools. 

How are individuals being notified? 

We are notifying individuals whose personal information was identified in files associated with services provided by Franciscan Medical Group and/or Franciscan Health in Washington state. Letters to affected individuals were sent via U.S. mail, beginning on December 1, 2022.