Ascension data breach: May 2024 ransomware attack, patient and staff files copied, 5.6 million people

What happened at Ascension?

Ascension detected unauthorized activity on some of its technology systems on May 8, 2024, from a ransomware attack, and investigated with cybersecurity experts. The investigation found that a cybercriminal had obtained a copy of some files on May 7 and 8. It notified law enforcement and government regulators.

Date	What happened	Source
February 29, 2024	Start of the breach window on Oregon's later report	Oregon list
May 7 and 8, 2024	Files copied	Ascension letter
May 8, 2024	Ransomware detected	Ascension letter; Oregon list
December 19, 2024	Letters dated; Oregon report of 5,599,699	Ascension letter; Oregon list
February 3, 2025	Second Oregon report: 5,466,931	Oregon list
April 4, 2025	IDX enrollment deadline	Ascension letter

Letters went out 225 days after the attack was detected. The notice-delay guide compares that with other notices.

What information was exposed in the Ascension breach?

It varies by person. The letter lists five groups: medical information, payment information, insurance information, government identification and other personal information. Insurance information means Medicaid or Medicare IDs, policy numbers or claims. Government identification means a Social Security, tax identification, driver's license or passport number. Other personal information means date of birth or address. The letter says the files hold information on both patients and Ascension associates.

How many people were affected?

Oregon report	Notice date	People
First	December 19, 2024	5,599,699
Second	February 3, 2025 (letters dated December 19, 2024)	5,466,931

Oregon's second report gives the breach window as February 29 to May 8, 2024. The list does not say why the second count is 132,768 lower. The largest healthcare breaches reported to HHS covers 2026 reports; Ascension's was filed in 2024.

Is this the same as the Ascension "former business partner" breach?

No. A separate Ascension letter, filed in Massachusetts, describes a different incident. Ascension learned on December 5, 2024 that patient information might be involved, and found on January 21, 2025 that it had disclosed information to a former business partner, from whom it was likely stolen through a flaw in third-party software. That letter covers inpatient visit details and Social Security numbers. If you got a 2025 letter mentioning a former business partner, it is about that incident, not the 2024 ransomware.

What did Ascension offer?

IDX identity protection at no cost: 24 months of credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy and managed identity theft recovery. The enrollment deadline was April 4, 2025, so it has passed. The assistance line was (866) 724-3233. A credit freeze at each of the three bureaus is free and has no deadline; the guide to credit monitoring offers explains the difference.

How many Washingtonians were affected by the Ascension breach?

Washington's attorney general lists a notice from Ascension Health, reported on December 19, 2024, with a breach date of February 29, 2024 and 5,787 Washingtonians affected. The record lists names, Social Security numbers, driver's license or state ID numbers, financial and banking information, full dates of birth, military ID numbers, passport numbers, health insurance policy or ID numbers and medical information as the information compromised. The breach date is the start of the window on Oregon's later report. The figure counts Washington residents only.

What the record leaves open

• Who carried out the ransomware attack; the letter does not name a group.
• Why Oregon's second report counts fewer people than the first.
• Why Oregon's later report starts the breach window on February 29, 2024, while the letter dates the file copying to May 7 and 8.