Ascension Health Data Breach Notice (Oregon Attorney General)

The filing from Ascension Health reveals that the personal information of 5,466,931 people was exposed in an incident that occurred on February 29, 2024. The organization did not notify Oregon authorities until February 3, 2025 — an interval of 340 days, or roughly 11 months.

Eleven months passed between the incident and the official filing

This gap is the single most striking fact in the record. State notification rules allow time for investigation, but nearly a year is long enough that many people will learn of the breach long after they might have taken early protective steps. The record itself supplies both dates and the number of people affected; nothing more is disclosed about when Ascension Health first identified the incident or what caused it.

What the exposed personal information actually means for you

The filing lists only one broad category: personal information. No passwords, no financial account numbers, and no permanent government identifiers such as Social Security numbers appear in the disclosed data fields. This is genuinely good news. Without those high-value identifiers, the immediate risk of new account fraud or tax-related identity theft is substantially lower than in many other large healthcare breaches.

However, the exposed personal information still carries lifelong value to identity thieves. Medical-related details combined with basic demographic data can be used to impersonate you when dealing with insurers, pharmacies, or government health programs. Once this information is out, it cannot be taken back. The people whose records were included now face an elevated risk of medical identity theft that may surface months or years from now.

Why the absence of certain data fields matters

Because no passwords were exposed, there is no need to change any Ascension-related login credentials. The account itself is not at direct risk from this incident. The real exposure is the non-credential personal information that cannot be reissued like a credit card or password. That permanence is what gives this breach its weight, even without the most dangerous identifiers.

The record does not state whether the data was copied and exfiltrated or simply viewed. It also does not name the precise initial access method. These uncertainties are common in breach notifications and do not change what you should focus on: protecting the information that was confirmed exposed.

How to determine if this filing concerns you

Ascension Health is required to notify affected individuals directly, usually by mail to the last known address. If you have not received a letter, it is likely your information was not included. However, if you have moved since February 29, 2024 — the date of the incident — the letter may have gone to an old address. In that case, contact Ascension Health directly to confirm whether your records were part of the 5,466,931 affected.

The lasting value of healthcare data

Unlike a credit card number that can be canceled, personal information tied to your medical history does not expire. Thieves can use it to file false claims, obtain prescriptions in your name, or create synthetic identities that mix your details with fabricated ones. The scale of this incident — more than 5.4 million people — means the exposed data could circulate for years on underground markets.

Because this is healthcare data, you should remain alert for unexpected Explanation of Benefits statements, bills for services you did not receive, or unfamiliar charges on insurance statements. These are often the first signs that someone is using your identity in a medical context.

What remains under your control

You cannot change the fact that this data now exists outside Ascension Health’s systems. You can, however, limit how effectively it can be used against you. Monitoring for misuse, freezing your credit even without a Social Security number exposed, and maintaining careful records of your own medical encounters are practical steps that reduce the practical harm.

The long delay between the February 2024 incident and the February 2025 filing does not change the categories of information exposed, but it does mean many people are only now learning their information may have been at risk for nearly a year. The letter remains the most reliable way to know for certain whether you are one of the 5,466,931 people named in this notification.