Microcode, Inc. (CommonSpirit Health) Data Breach Notice (Washington Attorney General)

The filing from the Washington Attorney General establishes that on January 19, 2026, an incident at Microcode, Inc. (CommonSpirit Health) exposed the records of 4,096 people. The organization notified the state on July 30, 2026 — 192 days later. That six-and-a-half-month gap is the single most striking fact in the record.

Exactly what this means for the people whose information was taken

If you received a letter from CommonSpirit Health, your name, Social Security number, full date of birth, driver’s license or Washington ID card number, passport number, financial and banking information, and medical information were among the categories listed in this filing. Not every person had every item exposed, but the combination that matters most is present: SSN paired with date of birth.

That specific pairing is the foundation for opening new credit accounts, filing fraudulent tax returns, claiming government benefits, or creating synthetic identities. Unlike a credit card, none of those identifiers can be cancelled or reissued. The exposure is permanent.

The medical information adds another lasting risk. It can be used to file false insurance claims, obtain prescription drugs in your name, or pressure you through targeted scams that reference real treatments or diagnoses. A passport number combined with a driver’s license and SSN makes it easier for someone to impersonate you across both government and financial systems.