Pinnacle Holdings / Pinnacle Healthcare Consulting Data Breach 2026: 18,313 Patients Exposed via Healthcare Consulting Vendor. 13-Month Notification Delay. What To Do

What happened

Pinnacle Holdings, LTD is the parent company of Pinnacle Healthcare Consulting LLC, a HIPAA business associate based in Centennial, Colorado. Founded in 1998 with approximately 129 employees, Pinnacle provides physician-compensation valuation, FMV / Stark / Anti-Kickback consulting, transaction support, revenue cycle, compliance / audit, and supply-chain services to hospitals, health systems, and physician groups nationwide.

Between November 11 and November 25, 2024, an unauthorized actor accessed Pinnacle’s network and exfiltrated data. Pinnacle discovered the disruption on November 25, 2024. The forensic review and downstream-client identification took 13 months — an unusually long delay. Pinnacle did not notify its downstream covered-entity clients (including Providence St. Joseph Orange and Corewell Health) until December 30, 2025.

Pinnacle’s own HHS OCR filing was dated April 7, 2026 — 17 months after the initial intrusion — confirming 18,313 affected individuals in the Pinnacle-direct count. Separate OCR filings by downstream covered entities cover additional patients: Providence St. Joseph Orange (11,329 California patients) and Corewell Health (~19,000+ Michigan patients). These are distinct OCR entries that should not be rolled up.

No ransomware group has publicly claimed responsibility.

What was stolen

The compromised data set is unusually broad:

Identity / financial: name, address, phone, email, DOB, SSN, driver’s license / state ID, taxpayer ID, passport, financial account, payment card, online credentials, digital signatures, biometric data.

Health-record: medical record number, patient / encounter ID, provider name, dates of service, diagnoses / treatment, prescriptions, Medicare / Medicaid numbers, insurance / claim / policy numbers, treatment costs.

The inclusion of online credentials, digital signatures, and biometric data alongside passport and ITIN is among the most complete identity-document sets exposed in any 2026 healthcare breach.

Who is affected (downstream covered entities)

Pinnacle serves many hospitals and physician groups. Publicly named downstream covered entities affected by this incident:

• Providence St. Joseph Orange (11,329 California patients — separate OCR filing)
• Corewell Health (Michigan, ~19,000+ patients — separate OCR filing)

Pinnacle’s full client roster is not public. If you received care from any hospital or physician group that used Pinnacle for revenue cycle or compliance consulting, your records may have been in the affected dataset even if your provider has not contacted you.

What Pinnacle is offering

• Complimentary credit monitoring and identity-theft protection (Providence’s notice specifies 2 years; Pinnacle’s own notice page does not state duration)
• Call center: 1-866-686-2607 (Monday to Friday)

What to do

1. Enroll in the offered monitoring.
2. Place free credit freezes at all three bureaus.
3. File IRS Form 14039.
4. If your passport was exposed, monitor for fraudulent travel-document activity.
5. Cancel and reissue any payment cards that may be tied to financial account information.
6. Change passwords on accounts where online credentials may have been exposed.
7. Stop the ongoing flow of your healthcare data. HealthConsent files HIPAA restriction requests across providers, insurers, HIEs, and prescription networks.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches