PIH Health pih.org PIH Health data breach: what happened and what to do
PIH Health, a California health system, was hit by a ransomware attack in late 2024 and reported in February 2026 that patient data was involved. The count listed with HHS is 2,947,264 people. Data includes names, medical and insurance info and, for some, Social Security numbers.
View all 13,115 breaches- Breach date
- 14 Nov 2024
- Made public
- 27 Feb 2026
- Affected
- 2,947,264
- Data exposed
- Names, Physical addresses, Medical information, Health insurance information, Social security numbers, Driver's licenses, Financial information
- Last updated
What happened
PIH Health, which runs hospitals and clinics in Southern California, was hit by a ransomware attack in late 2024 that disrupted IT and phone systems. The activity on its network started on November 14, 2024. A group claimed to have stolen 17 million patient records, but HIPAA Journal reports that figure looks inflated.
PIH finished its review of the affected files in February 2026 and reported the breach to the California Attorney General on February 27, 2026. The count listed on the HHS breach portal is 2,947,264 people.
What was exposed
Reporting on the notices lists names, addresses, medical information and health insurance information, Social Security numbers, driver's license numbers and financial account details. Not everyone's record held every item, so your letter is the best guide to your own exposure.
Medical details with a Social Security number let a criminal pose as you at a clinic or pharmacy, or open credit. They also make phishing convincing, since a message can name a real provider.
PIH Health's response
PIH Health mailed notices and offered affected people free credit monitoring and identity theft protection. The notice explains how to enroll. The gap between the attack and the notices was more than a year, so assume the data has had plenty of time to circulate and act now.
What to do if you were in it
- 1
Use the free monitoring in your letter
If PIH Health wrote to you, enroll using the instructions in the notice.
- 2
Freeze your credit at all three bureaus
A freeze stops lenders from opening new accounts in your name. It's free and you can lift it when you need credit. Do it at Equifax, Experian and TransUnion, since each bureau keeps its own file.
- 3
Review insurance statements for care you didn't get
Read each explanation of benefits. Unfamiliar visits or prescriptions can mean someone used your coverage. Tell your insurer and PIH Health.
- 4
Don't trust unexpected calls about your care
Scammers use real provider names and real conditions. Hang up and call the number on your card or the PIH Health website.
- 5
Watch your bank and card statements
If financial account details were in your letter, tell your bank and ask about new account numbers.
- 6
Check whether your email or phone is in this and other breaches
Run a free scan at serus.ai. Serus monitors breach databases and the dark web and alerts you when your info shows up. It can't remove data that has already leaked, so the steps here still matter.
Frequently asked
Was I affected by the PIH Health breach?
If you received a notice from PIH Health in 2026, yes. The notice lists the data involved in your case.
How many people were affected?
The HHS breach portal lists 2,947,264 individuals. The attackers' claim of 17 million records was not borne out.
What was exposed?
Names, addresses, medical and health insurance information, Social Security numbers, driver's license numbers and financial account details, depending on the person.
Should I change any passwords?
The reports don't list passwords as exposed, but if you use a PIH patient portal, a fresh password and two-factor login are a cheap precaution.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
