St. Mary's Health

ST. MARY'S HEALTH D/B/A ST VINCENT EVANSVILLE filed a data-breach notice with the Illinois Attorney General during 2022 (case 2022-063). The register records the breach as discovered on March 22, 2021. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

St. Mary's Health, Inc. d/b/a St. Vincent Evansville disclosed a cybersecurity incident discovered on Feb 12, 2018. A configuration error on a credentialing software server exposed patient/staff PII (names, DOB, SSN, DLs) to the internet. Unauthorized external actors attempted to download data. The server was taken offline and reconfigured. No evidence of data misuse or dark web posting was found. Affected individuals were offered 1 year of Experian IdentityWorks.

St. Mary's Health, Inc. d/b/a St. Vincent Evansville notified the NH Attorney General of a data incident affecting 4 New Hampshire residents. On February 12, 2018, the hospital detected unusual internet traffic accessing a server hosting credentialing software. Investigation revealed a server configuration error that exposed data to the internet. The server was taken offline and reconfigured. Forensic analysis indicated unauthorized access attempts from outside the US, but no evidence of data posting to the dark web was found. Affected data included names, addresses, dates of birth, phone numbers, driver's licenses, SSNs, and National Provider Data Bank reports. The hospital offered one year of identity theft monitoring.

St. Mary's Health (Indiana) reported to HHS on 2015-03-05 a Hacking/IT Incident affecting 3,952 individuals. On December 3, 2014, a phishing email attack compromised several employees' usernames and passwords. Exposed PHI included patient names, addresses, dates of birth, clinical information, and in some cases, Social Security numbers. Breached information was located in Email systems. OCR obtained documented assurances of corrective action, including deployment of a phishing/malware awareness program.