Almeida Law Group is investigating a data breach at Trinity Health. If you were affected, contact Almeida Law Group.
About Trinity Health
Trinity Health is one of the largest not-for-profit Catholic health care systems in the United States, headquartered in Livonia, Michigan. Founded in 2000 through a merger of Holy Cross Health System and Mercy Health Services, the organization operates 92 hospitals across 22 states and employs more than 120,000 people, including nearly 26,000 physicians and clinicians. Because Trinity Health operates as a healthcare system, it handles protected health information and other sensitive personal data for a large patient population, making any security incident a matter of serious concern for those it serves.
What Happened?
Trinity Health was listed in an HHS Office for Civil Rights breach portal report submitted on September 30th, 2026. The filing describes a Hacking/IT Incident affecting network servers and other locations, with 33,234 individuals identified as affected. Trinity Health is listed as a Business Associate in the filing, which may indicate it was acting in that capacity for another covered entity or that a business associate was involved in the incident — the available information does not clarify that distinction. The specific types of data compromised were not identified in the filing, and no public breach notification letters or news coverage specifically addressing this incident were found as of the research date.
This incident appears to be separate from an earlier January 2026 breach involving Trinity Health and Health Gorilla, a health information exchange partner, which affected 5,905 individuals and led to a proposed class action filed on March 20th, 2026 in the U.S. District Court for the Eastern District of Michigan. Trinity Health also has a broader breach history that includes a 2020 Blackbaud ransomware incident affecting approximately 3.32 million individuals, a 2021 Accellion FTA breach affecting over 500,000 individuals, a December 2022 employee email account compromise, and a March–April 2023 hacking incident at Mercy Health Network that affected roughly 21,000 patients and resulted in a separate class action lawsuit.
Key Facts at a Glance
- Company or Organization: Trinity Health
- Industry: Healthcare / Hospital Systems (not-for-profit Catholic health system)
- Location: Livonia, Michigan
- Incident type: Hacking/IT Incident
- Date breach discovered: September 30th, 2026
- Total persons affected: 33,234
- Prior breach: Yes — multiple prior incidents since 2020, including Blackbaud (2020), Accellion (2021), employee email compromise (2022), Mercy Health Network hacking incident (2023), and Health Gorilla/HIE unauthorized disclosure (2026)
- Litigation status: A proposed class action was filed March 20th, 2026 in the Eastern District of Michigan related to the earlier Health Gorilla/HIE breach; no litigation specific to this September 2026 filing has been reported
- Source: HHS Office for Civil Rights breach portal report; Wikipedia – Trinity Health; Becker’s Hospital Review – Trinity Health, Health Gorilla Sued; HIPAA Journal – Class Action Lawsuit
What Should You Do?
If you received a notification from Trinity Health related to this incident, consider enrolling in any identity protection services offered and take note of any enrollment deadlines. Even if specific data types have not been publicly confirmed, it is a good idea to place a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — and to monitor your credit reports for unfamiliar activity. You can request free annual reports at AnnualCreditReport.com. If you suspect identity theft has already occurred, visit IdentityTheft.gov for step-by-step guidance. Because Trinity Health is a healthcare provider, you should also review any Explanation of Benefits statements from your insurer and check your medical records for services you did not receive, which can be a sign that your health information was misused.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
