PIH Health Ransomware Attack: 2.9M Patients Exposed in December 2024 Breach. What to Do

What happened

PIH Health is a nonprofit regional health system based in Whittier, California, operating three hospitals — PIH Health Whittier Hospital, PIH Health Downey Hospital, and PIH Health Good Samaritan Hospital (Los Angeles) — along with urgent care centers, physician offices, home health, and hospice services across Los Angeles, Orange, and San Bernardino counties.

On December 1, 2024, PIH Health detected suspicious activity inside its network. The intrusion was a ransomware attack. Forensic investigators later confirmed that an unauthorized actor had been inside PIH Health’s environment from November 14, 2024 through December 23, 2024 — a 40-day window. PIH Health filed its HIPAA breach notification with HHS OCR on January 31, 2025, reporting 2,947,264 individuals affected. Final individual notification letters were not completed until February 25, 2026, more than 14 months after detection.

No established ransomware-as-a-service brand (LockBit, BlackCat/ALPHV, INC Ransom) claimed the attack on a dark-web leak site. On December 13, 2024, a threat actor using the handle “Dreamer2000” posted on an open web forum claiming to have exfiltrated approximately 2 terabytes of data including roughly 17 million patient records, and a portion of the stolen data was leaked online. PIH Health stated it was unable to verify those specific volume claims; the OCR-reported figure of 2.9 million remains the authoritative count of affected individuals.

What was stolen

Per the PIH Health notice of data breach filed with the California Attorney General, the exposed data varies by individual but may include:

• Full name and address
• Medical information
• Health insurance information
• Social Security number
• Taxpayer identification number
• Driver’s license number
• Financial account information
• Credit or debit card number

This is among the most complete identity packages a breach can produce — government IDs, financial accounts, and full medical history in a single dataset.

Operational disruption — this attack hit patient care directly

Unlike the typical “files-only” healthcare breach, the PIH Health ransomware attack caused multi-day operational paralysis across the entire system. Public reporting and PIH Health’s own patient communications document:

• System-wide outages of electronic medical records, laboratory systems, pharmacy systems, radiology, patient registration, internet access, and phone systems.
• Phone systems failed at Whittier and Downey hospitals; calls were rerouted to Good Samaritan in Los Angeles, which was on a separate system.
• Surgeries and procedures were cancelled due to the technology outage.
• Pharmacy services on manual paper-only processing, with no electronic prescriptions or refills and no controlled-substance dispensing via paper.
• Laboratory and radiology required physical paper physician orders; results were delayed.
• Online appointment scheduling was unavailable; patients in active treatment had to be triaged manually.
• The disruption was still ongoing at least 12 days after detection.

PIH Health notified local police and the FBI, which opened a criminal investigation.

What PIH Health is offering

PIH Health is offering complimentary credit monitoring and identity-theft protection services to affected individuals. The notification letter specifies the enrollment instructions and code. The duration and identity-protection vendor are stated in your individual notification letter — read it carefully and enroll.

Class actions

A class action was filed on March 12, 2026 in California Superior Court for Los Angeles County — Gonzalez v. PIH Health, Inc. (Potter Handy LLP) — alleging violations of California’s Confidentiality of Medical Information Act (CMIA) and common-law negligence. Multiple other plaintiff firms (Kantrowitz Goldhamer, Strauss Borrelli, Migliaccio & Rathod, Lyon Firm, CaseyGerry) are publicly investigating additional class actions.

PIH Health is also no stranger to federal enforcement: in April 2025, OCR finalized a $600,000 HIPAA settlement with PIH Health over a separate 2019 phishing incident (189,763 individuals affected), citing failures of risk analysis and timely breach notification. The current 2024 ransomware incident is being investigated by OCR separately.

What to do if you’re affected

1. Enroll in the complimentary credit monitoring and identity-theft protection offered in your notification letter. Don’t skip it — this breach exposed government IDs and financial accounts.
2. Place free credit freezes with Equifax, Experian, and TransUnion. This is the single highest-leverage step against new-account identity fraud. It takes about ten minutes per bureau.
3. Watch your Explanation of Benefits statements for unfamiliar claims — medical-identity fraud is the harder-to-detect downstream risk.
4. If your driver’s license number was exposed, request a duplicate license at the CA DMV (which generates a new number) if you see any suspicious activity.
5. File a police report if you observe identity theft — required by some banks and creditors to dispute fraudulent accounts.
6. Stop the ongoing flow of your medical data. HealthConsent files HIPAA restriction requests under 45 CFR § 164.522 so the diagnosis and treatment data exposed in this breach is not continuously re-shared with downstream payors, vendors, and data brokers.

Continue reading

• Your eight HIPAA rights, in plain English
• How to file a HIPAA restriction request
• Other 2025 healthcare data breaches