Ascension Health ascension.org Ascension Health data breach: what happened and what to do
Ascension said 437,329 people had personal and health information exposed in a December 2024 breach at a former business partner. Names, addresses, contact details, dates of birth, Social Security numbers and clinical details were involved. Ascension's own systems weren't breached.
View all 13,115 breaches- Breach date
- Dec 2024
- Made public
- 28 Apr 2025
- Affected
- 437,329
- Data exposed
- Names, Physical addresses, Phone numbers, Email addresses, Dates of birth, Social security numbers, Medical information, Health insurance information
- Last updated
What happened
Ascension, one of the largest US health systems, told patients in spring 2025 that their information had been exposed through a former business partner. According to BleepingComputer and HIPAA Journal, Ascension learned of the partner's hacking incident on December 5, 2024. On January 21, 2025 it determined that patient data had been shared with that partner and was likely stolen. Ascension said its own networks, systems and electronic health records weren't affected.
The US health regulator's breach portal lists 437,329 people. Ascension hasn't publicly named the partner.
What was exposed
Reports list names, addresses, phone numbers, email addresses, dates of birth, race, gender and Social Security numbers. Clinical details tied to inpatient visits were also included: place of service, physician names, admission and discharge dates, diagnosis and billing codes, medical record numbers and the name of the insurer.
That mix matters. A Social Security number plus a date of birth is what criminals need to open credit in your name. Visit details and insurer names make phishing calls and texts that claim to be from a hospital or insurer sound real.
The company's response
Ascension is offering two years of free identity monitoring through Kroll, covering credit monitoring, fraud support and identity theft restoration.
What this means for you
If you got a letter, enroll in the monitoring and freeze your credit. If you didn't, you can still check whether your details turn up in other breaches.
What to do if you were in it
- 1
Freeze your credit
Placing a freeze at Equifax, Experian and TransUnion stops most new accounts being opened in your name. It's free and you can lift it when you need credit (FTC guide).
- 2
Take the free monitoring
If Ascension sent you a letter, it includes an enrollment code for two years of Kroll identity monitoring. Use it before the deadline in the letter.
- 3
Read your health statements
Check explanations of benefits and insurer statements for visits or claims you don't recognize. Report them to your insurer.
- 4
Expect scam calls and texts
Treat any message that mentions Ascension, your hospital visit or your insurer with suspicion. Call the number on your card or statement, not the one in the message.
- 5
Check other breaches
Check whether your email or phone number shows up in this and other breaches. A free scan from Serus looks across breach databases and the dark web and alerts you when your data appears.
Frequently asked
Was I affected by the Ascension data breach?
Ascension notified affected people by letter starting at the end of April 2025. If you were a patient and got no letter, contact Ascension to ask.
Was Ascension itself hacked?
Ascension says the data was exposed through a former business partner's hacking incident and that its own systems weren't affected.
What was exposed?
Names, addresses, phone numbers, email addresses, dates of birth, Social Security numbers and clinical details such as diagnosis codes, visit dates and insurer names.
Should I freeze my credit?
If your Social Security number was in the notice, yes. A freeze is free at all three bureaus.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
