Spokane Digestive Disease Center 2026 Data Breach

The 2026 Spokane Digestive Disease Center data breach was a cyber incident involving unauthorized access to an employee email account. According to the official Washington state filing, the account was accessed on certain dates between January 22 and February 18, 2026.

The U.S. Department of Health and Human Services initially recorded 501 affected individuals. A later filing with the Washington Attorney General confirms that notices were mailed to 2,093 Washington residents alone on May 26, 2026. The published affected population is therefore at least 2,093.

Verified Incident Timeline

Spokane Digestive Disease Center identified suspicious activity on February 19, 2026, secured its email environment, and began an investigation. The investigation determined that unauthorized access occurred between January 22 and February 18. The email and attachment review was completed on May 8, and written notices were mailed to Washington residents on May 26.

What Information May Have Been Affected?

The Washington filing lists names, dates of birth, driver's-license or state-identification-card numbers, Social Security numbers, financial-account information, credit-card information, electronic signatures, and medical information. The information involved may vary by person.

How the Organization Responded

The organization secured the account, assessed the security of its email environment, and reviewed the material to identify affected individuals. It also planned additional safeguards and employee training to reduce the likelihood of a similar event. Potentially affected people were offered one year of complimentary Experian credit monitoring and identity-theft protection.

What Should Affected People Do?

Notice recipients should check their letter for the enrollment deadline for the offered monitoring service and review financial accounts, credit reports, and health-insurance records for an unfamiliar transaction or service. People whose Social Security or government-identification information was affected may also consider a fraud alert or credit freeze based on their circumstances.