Spokane Digestive Disease Center 2026 Data Breach
The 2026 Spokane Digestive Disease Center data breach was a cyber incident involving unauthorized access to an employee email account. According to the official Washington state filing, the account was accessed on certain dates between January 22 and February 18, 2026.
This classification is based on a reviewed lower bound; the actual impact and severity may be higher.
Exposed Data Types
1 sensitive8- Medical information
- Names
- Dates of birth
- Driver's license numbers
- Government issued IDs
- Social security numbers
- Financial account information
- Credit card numbers
About This Breach
The U.S. Department of Health and Human Services initially recorded 501 affected individuals. A later filing with the Washington Attorney General confirms that notices were mailed to 2,093 Washington residents alone on May 26, 2026. The published affected population is therefore at least 2,093.
Verified Incident Timeline
Spokane Digestive Disease Center identified suspicious activity on February 19, 2026, secured its email environment, and began an investigation. The investigation determined that unauthorized access occurred between January 22 and February 18. The email and attachment review was completed on May 8, and written notices were mailed to Washington residents on May 26.
What Information May Have Been Affected?
The Washington filing lists names, dates of birth, driver's-license or state-identification-card numbers, Social Security numbers, financial-account information, credit-card information, electronic signatures, and medical information. The information involved may vary by person.
How the Organization Responded
The organization secured the account, assessed the security of its email environment, and reviewed the material to identify affected individuals. It also planned additional safeguards and employee training to reduce the likelihood of a similar event. Potentially affected people were offered one year of complimentary Experian credit monitoring and identity-theft protection.
What Should Affected People Do?
Notice recipients should check their letter for the enrollment deadline for the offered monitoring service and review financial accounts, credit reports, and health-insurance records for an unfamiliar transaction or service. People whose Social Security or government-identification information was affected may also consider a fraud alert or credit freeze based on their circumstances.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
