Corewell Health 2024 Data Breach

Pinnacle Holdings, LTD says a "network disruption" was discovered in the company’s systems on November 25, 2024.  Pinnacle Holdings is a subcontractor to Corewell Health and estimates are that the data of 19,000 Corewell patients were stolen.  There is no current legal requirement for businesses to notify Attorney General Dana Nessel about data breaches, however AG Nessel has called for legislation requiring data breach reporting:

https://www.wlns.com/news/19000-corewell-health-patients-affected-by-data-breach/

https://askphc.com/dataincident2024dataownersnoticenotice-of-data-incident/

19,000 Corewell Health patients affected by data breach
By Shajaka Shelton - March 27, 2026

LANSING, Mich. (WLNS) — Approximately 19,000 Corewell Health patients may have had their personal information compromised in a 2024 data breach that affected Corewell vendor Pinnacle Holdings, the Michigan-based healthcare company announced Friday.

Corewell spokeswoman Sharon Stanton says the company was “recently notified” of the event and launched a data review to determine who was impacted, allowing Pinnacle, who previously provided healthcare consulting services to Corewell, to mail notification letters to more than 19,000 Corewell patients as well as other affected individuals.

In a post to their website, Pinnacle says a network disruption occurred in some of the company’s systems on Nov. 25, 2024. The investigation triggered by this event later uncovered that some information in the company’s network may have been subject to unauthorized access between Nov. 11 and Nov. 25, 2024.

Pinnacle says the affected information differed from person to person but may have included one or more of the following:

• Name
• Address
• Phone number
• Email address
• Social Security/taxpayer ID number
• Driver’s license/state ID/passport number
• Financial account/payment card information
• Online account credentials
• Digital signature
• Biometric data
• Date of birth
• Medical treatment, diagnosis, or billing information
• Prescription information
• Date of service
• Patient ID number
• Encounter ID number
• Provider name
• Patient account number
• Medical record number
• Medicare/Medicaid number
• Health insurance information

Pinnacle says they have addressed the incident and taken steps to prevent similar things from happening in the future.

They also say they are unaware of specific fraudulent activities that have happened as a result of the incident.

Pinnacle is also offering free credit monitoring and identity protection services to those affected by the breach. Impacted individuals who have questions and concerns can call Pinnacle’s dedicated call center at 866-686-2607.