Incident BriefingsCommonSpirit Health security incident

CommonSpirit Health security incident

Ransomware. EHR outage across multiple states for weeks; delayed chemo appointments.

Last modified

Summary

  • Environment: Hospital system (140+ hospitals)
  • Operational impact: EHR outage across multiple states for weeks; delayed chemo appointments
  • Financial impact: No financial figure is established by the reviewed source evidence
  • Record status: Developing record. Reviewed September 19, 2026; updated as evidence emerges.

What happened

In 2022, CommonSpirit Health experienced an incident in its hospital system (140+ hospitals) environment. The retained source describes the attack path as follows: Ransomware. [1]

The documented consequence was: EHR outage across multiple states for weeks; delayed chemo appointments. [1]

Impact

  • Documented impact: EHR outage across multiple states for weeks; delayed chemo appointments. [1]
  • No financial loss, ransom amount, recovery cost, or regulatory penalty is established by the reviewed source evidence.

Timeline

  1. Documented public update

    The CommonSpirit Update records the incident facts used in this briefing.

    [1]

  2. Briefing updated

    This briefing was last reviewed and updated on September 19, 2026.

Threat Group & Attack Vector

The retained source describes the attack path as follows: Ransomware. The canonical record does not add intrusion steps beyond those supported by the source. [1]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

Response

The retained source reports coordination with law enforcement as part of the incident response. [1] The retained source describes a forensic or specialist investigation of the incident. [1]

This account is bounded to CommonSpirit Update. Details absent from that evidence are left unresolved rather than inferred. [1]