In October 2022, **CommonSpirit Health**, one of the largest nonprofit Catholic health systems in the U.S. (operating in **Alabama, Arizona, California, Colorado, Iowa, Kansas, Kentucky, Nebraska, Nevada, New Mexico, Ohio, South Carolina, Tennessee, Texas, Virginia, and Washington**), fell victim to a **ransomware attack** that crippled its IT systems across **140 hospitals and 1,000+ care sites**. The attack, attributed to **criminal hackers**, forced emergency room diversions, delayed surgeries (including critical procedures like cancer treatments), and disrupted access to electronic health records (EHRs) for weeks. Patient data—including **medical histories, financial records, and personally identifiable information (PII)**—was encrypted, with threat actors demanding a ransom for decryption. While CommonSpirit confirmed no evidence of **data exfiltration for extortion**, the operational outage **threatened patient safety**, as clinicians reverted to paper records, increasing risks of errors. The incident also triggered **regulatory scrutiny** under HIPAA, with potential fines for compliance failures. The financial toll exceeded **$150 million** in recovery costs, excluding reputational damage from public distrust and patient lawsuits. The attack underscored vulnerabilities in healthcare cybersecurity, particularly for **large, multi-state providers** reliant on interconnected systems.
TPRM report: https://www.rankiteo.com/company/commonspirithealth
"id": "com3393533102425",
"linkid": "commonspirithealth",
"type": "Ransomware",
"date": "10/2022",
"severity": "100",
"impact": "7",
"explanation": "Attack that could injure or kill people"{'affected_entities': [{'location': ['Alabama',
'Alaska',
'Arizona',
'Arkansas',
'California',
'Colorado',
'Connecticut',
'Delaware',
'Florida',
'Georgia',
'Hawaii',
'Idaho',
'Illinois',
'Indiana',
'Iowa',
'Kansas',
'Kentucky',
'Louisiana',
'Maine',
'Maryland',
'Massachusetts',
'Michigan',
'Minnesota',
'Mississippi',
'Missouri',
'Montana',
'Nebraska',
'Nevada',
'New Hampshire',
'New Jersey',
'New Mexico',
'New York',
'North Carolina',
'North Dakota',
'Ohio',
'Oklahoma',
'Oregon',
'Pennsylvania',
'Rhode Island',
'South Carolina',
'South Dakota',
'Tennessee',
'Texas',
'Utah',
'Vermont',
'Virginia',
'Washington',
'Washington D.C.',
'West Virginia',
'Wisconsin',
'Wyoming',
'Puerto Rico',
'US Virgin Islands',
'Armed Forces Americas',
'Armed Forces Pacific',
'Armed Forces Europe',
'Northern Mariana Islands',
'Marshall Islands',
'American Samoa',
'Federated States of Micronesia',
'Guam',
'Palau',
'Alberta, Canada',
'British Columbia, Canada',
'Manitoba, Canada',
'New Brunswick, Canada',
'Newfoundland, Canada',
'Nova Scotia, Canada',
'Northwest Territories, Canada',
'Nunavut, Canada',
'Ontario, Canada',
'Prince Edward Island, Canada',
'Quebec, Canada',
'Saskatchewan, Canada',
'Yukon Territory, Canada']}]}