2021 OSF Healthcare — Nephilim ransomware; 53,907 PHI (OCR settles 2026)
Data compromised
Driver’s license numbers, diagnosis/treatment, prescriptions, medical record numbers, provider names, dates of service, financial account info, health insurance information
Technical writeup
Verified. In April 2021 OSF Healthcare discovered Nephilim ransomware and exfiltration of PHI for 53,907 individuals (filed with HHS Oct 2021). On July 30, 2026, HHS OCR announced a settlement: $552,250 payment plus a two-year corrective action plan, citing failures including risk analysis, impermissible disclosure of the 53,907 individuals’ PHI, and untimely individual/HHS breach notification. OSF is headquartered in Illinois with providers in Illinois and Michigan.
Root cause
Nephilim ransomware infection (discovered Apr 2021); PHI exfiltrated; HHS OCR later settled HIPAA investigation
References
- https://www.hhs.gov/press-room/hhs-ocr-settles-ransomware-investigation-with-healthcare-system.html
- https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/ra-cap-with-osf-healthcare-system/index.html
- https://databreaches.net/2026/07/30/hhs-ocr-settles-ransomware-investigation-of-osf-healthcare-system-and-affiliated-covered-entities/
- https://www.hipaajournal.com/osf-healthcare-hipaa-penalty/