HackingHealthcareHealthcareStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedPHIHealth (basic)Identity (basic)Government IDMediumActive

TRINITY HEALTH CORPORATION

bd_fca136ef3526c4bd · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 13, 2026

Filed

Mar 13, 2026

To disclose

8 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

67%

Full breach record for TRINITY HEALTH CORPORATION →19 incidents on file

Trinity Health notified Vermont AG of a potential unauthorized disclosure of patient health information via HIE partner Health Gorilla on Jan 13, 2026. Data may include clinical details, demographics, insurance info, and driver's license numbers. Trinity Health suspended the involved companies from the HIE and is offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Vermont clock⏱ VT AG >14 bday8 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 8 weeks / 59 days

Jan 13, 2026

Discovered

Mar 13, 2026

Filed

vs. sector median

3 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_2ccee3e4730d4a912026-03-13Verified
HHS OCRbd_d81b9dbc3315affc2026-03-13Verified
Illinois State AGbd_34e3209ac023257a2026-03-01 · +12dCandidate

Name: TRINITY HEALTH CORPORATION
norm: trinity health
Domain: trinity-health.org

Name: TRINITY HEALTH CORPORATION
norm: trinity health
Domain: trinity-health.org
Industry: Healthcarellm

Discovered: Jan 13, 2026
Materiality determined: —
Notification sent: Mar 13, 2026
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: Partner
Regulator citations: Filed notice with Vermont Attorney General
Third party: via Health Gorilla
Initial access: trusted_relationship

During the incident: Providing complimentary credit monitoring
Suspended companies involved from participation in the HIE
Changes made: HIE is investigating these disclosures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: VT AG >14 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Illinois State AGMar 1 · first

Massachusetts State AG+12d

HHS OCR+12d

Vermont State AG+12d · this page

Pattern: first filing Mar 1 (IL), last Mar 13 (VT) — a 12-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2026-03-13-trinity-health-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 13, 2026
Raw hash: e008de3cd8aaaca618e048b46f4b294b9446d33737000749eb75efc85fad5539

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityTRINITY HEALTH CORPORATION

Victim entityTRINITY HEALTH CORPORATION

Incidentdiscovered Jan 13, 2026

Stated responseProviding complimentary credit monitoring

ComplianceVT AG >14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov