Mercy Health

MERCYHEALTH filed a data-breach notice with the Illinois Attorney General in February 2026 (case 26-02-1000). The register records the breach as discovered on January 15, 2025. Personal information types reported: medical information. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

MERCYHEALTH filed a data-breach notice with the Illinois Attorney General in February 2026 (case 26-02-1010). The register records the breach as discovered on August 15, 2025. Personal information types reported: medical information. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

MERCYHEALTH filed a data-breach notice with the Illinois Attorney General in February 2026 (case 26-02-1003). The register records the breach as discovered on January 30, 2025. Personal information types reported: medical information. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

MERCYHEALTH filed a data-breach notice with the Illinois Attorney General in February 2026 (case 26-02-1009). The register records the breach as discovered on January 15, 2025. Personal information types reported: medical information. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

MERCYHEALTH filed a data-breach notice with the Illinois Attorney General in February 2026 (case 26-02-1002). The register records the breach as discovered on September 5, 2025. Personal information types reported: medical information. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

MERCYHEALTH filed a data-breach notice with the Illinois Attorney General in February 2026 (case 26-02-1006). The register records the breach as discovered on January 13, 2025. Personal information types reported: medical information. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

MERCYHEALTH filed a data-breach notice with the Illinois Attorney General in February 2026 (case 26-02-1005). The register records the breach as discovered on November 26, 2025. Personal information types reported: medical information. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

MERCYHEALTH filed a data-breach notice with the Illinois Attorney General in February 2026 (case 26-02-996). The register records the breach as discovered on August 21, 2025. Personal information types reported: medical information. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

MERCYHEALTH filed a data-breach notice with the Illinois Attorney General in February 2026 (case 26-02-1008). The register records the breach as discovered on January 23, 2025. Personal information types reported: medical information. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

Mercy Health reported to HHS on 2020-12-04 a Unauthorized Access/Disclosure affecting 11,187 individuals. Breached information located on Electronic Medical Record. An employee impermissibly accessed PHI including names, addresses, DOB, diagnoses, and lab results. The entity sanctioned the employee, provided credit monitoring, and implemented technical safeguards.

Mercy Health Foundation, Inc. notified Montana residents of a ransomware incident affecting its third-party vendor, Blackbaud, Inc. The attack occurred in May 2020, with notification received on July 16, 2020. Exfiltrated data included names, dates of birth, and health visit details. No SSNs or financial data were compromised.

Mercy Health Foundation, Inc. notified individuals of a ransomware incident involving its third-party vendor, Blackbaud, Inc. The attack occurred in May 2020, and the Foundation was notified on July 16, 2020. The incident potentially exposed donor names, dates of birth, and health visit details. Sensitive data like SSNs and financial card numbers were encrypted. No fraud was identified.

MERCY HEALTH FOUNDATION filed a data-breach notice with the Illinois Attorney General during 2020 (case 20-372). The register records the breach as discovered on July 16, 2020. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.