CommonSpirit Health MyChart Lawsuit: No Tracking Case, One New Breach Suit
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
As of October 8, 2026, we found no commonspirit health mychart lawsuit over Meta Pixel or Google tracking on its websites or patient portal. The commonspirit lawsuit that is open is different: a lawsuit filed August 4, 2026 in federal court in Chicago that attaches a breach notice letter; we could not read the complaint, so we cannot confirm it is a class action. The suits over the 2022 ransomware attack were dismissed. There is no settlement, no fund and no claim form.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Each CommonSpirit Case Is About
CommonSpirit Health is the Chicago-based Catholic system behind CHI Health, Dignity Health and Virginia Mason Franciscan Health, among others. Three separate things get called a “commonspirit data breach”:
The 2022 ransomware attack. An intruder was in CommonSpirit’s systems from September 16 to October 3, 2022; ransomware hit on October 2, 2022. CommonSpirit reported 623,774 affected people to HHS. Exposed fields included names, addresses, providers, medical record numbers, treatment and prescription details and insurance information. Some facilities lost patient portal access for weeks.
The Pinnacle vendor breach. Pinnacle Holdings, a vendor of CommonSpirit’s consultant NorthGauge Healthcare Advisors, was hit by ransomware between November 11 and November 25, 2024. CommonSpirit was told about affected Washington residents on February 2, 2026; the Washington filing counts 19,027 people.
The MicroCode vendor breach. MicroCode Software Services, which hosted a CommonSpirit malpractice-insurance database, reports access from January 19 to April 14, 2026. It told the Washington Attorney General on July 30, 2026 that 4,096 residents were affected; it says names and dates of birth were involved, not Social Security numbers.
Tracking. We found no lawsuit alleging that CommonSpirit shared portal or website activity with Meta or Google.
Case Details
Open: Perkins v. CommonSpirit Health, No. 1:26-cv-09254, U.S. District Court for the Northern District of Illinois, filed August 4, 2026 by Sonya Perkins and assigned to Judge Lindsay C. Jenkins. The complaint attaches a breach notice letter as Exhibit A. We could not read the complaint, so we cannot confirm which incident it covers.
Closed (2022 attack): Perkins v. CommonSpirit Health, No. 1:22-cv-07313 (N.D. Ill.), was the lead case; Koch v. CommonSpirit Health, No. 1:23-cv-00228, was joined to it. Judge Harry D. Leinenweber dismissed the lead case on October 5, 2023 for lack of standing. Maser v. CommonSpirit Health, No. 1:23-cv-01073 (D. Colo.), drew a recommendation to dismiss for lack of standing and was terminated on December 3, 2024.
Status: One Open Breach Suit, No Settlement
We found no payment to patients in the 2022 ransomware suits. In Perkins, the court said the plaintiffs “do not allege that they have suffered any fraudulent activity to date.”
On tracking: we searched federal dockets for cases naming CommonSpirit and found none about Meta Pixel or Google Analytics. We did not search every state court. If one is filed, we will update this page.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Are You Affected?
For the breach suit: the test is your mail. If you received a notice letter from CommonSpirit, NorthGauge or MicroCode, keep it and the envelope. It lists which fields were exposed and is your proof if a class is ever certified or a settlement reached. You do not sign up anywhere now.
For tracking: no case exists, so nobody is eligible for anything. What you can note is how you used CommonSpirit online. In Washington, Virginia Mason Franciscan Health moved patients to the CommonSpirit Patient Portal, powered by MyChart, which replaced MyVirginiaMason. Other regions may use a different portal name.
Our form on this page asks whether you used a CommonSpirit website or the portal, what you did there, and when you last did it. That helps you match yourself to a case if one is filed. To see how tracking cases against other hospitals ended, use the MyChart claim form guide.
What a CommonSpirit Case Could Pay
For context only: hospital tracking settlements elsewhere have paid small per-patient amounts, often split pro rata among claimants. See Advocate Aurora and Wellstar. Healthcare breach settlements usually combine reimbursement for documented losses with a small flat payment. The MyChart calculator and the data breach calculator use those results. They are not a prediction for CommonSpirit.
How cases like this one end
Our copy of the federal courts’ own case database covers 15,171 other personal property damage casesclosed in U.S. federal district courts between 2015 and 2025, 10.4% of them filed as class actions:
- 33.2% ended in a settlement recorded by the court. Another 19.2% were dismissed voluntarily, which often follows a private settlement — so the real settlement share sits between 33.2% and 52.3%.
- 5.9% were decided on a motion before any trial.
- 1 in 90 reached a trial (1.1%), after a median of 27.4 months.
- Median time from filing to the end of the case: 8.5 months.
- Only 236 of them (1.6%) record a money award at all; the median of those is $496,000.
These are base rates for this type of case (federal other personal property damage cases) — not a prediction about this lawsuit, and not legal advice. Source: Federal Judicial Center, Integrated Database (civil), analysed by Settlement Insight. Cases heard in state courts are not included.
CommonSpirit Lawsuit Timeline
- 1
October 2, 2022 — Ransomware Attack
Ransomware hits CommonSpirit after an intruder got in on September 16, 2022. CommonSpirit later reports 623,774 affected people to HHS.
- 2
October 5, 2023 — Lead Breach Case Dismissed
Judge Leinenweber dismisses Perkins (1:22-cv-07313) for lack of standing. Koch is closed on March 22, 2024 as a result.
- 3
December 3, 2024 — Colorado Case Ends
Maser (1:23-cv-01073), where a magistrate judge recommended dismissal for lack of standing, is terminated. We found no settlement in any 2022-breach case.
- 4
February 2026 — Pinnacle Vendor Breach Disclosed
A Washington filing on behalf of CommonSpirit counts 19,027 residents affected by the November 2024 Pinnacle ransomware attack.
- 5
July 30, 2026 — MicroCode Breach Disclosed
MicroCode reports 4,096 Washington residents in a malpractice-insurance database it hosted for CommonSpirit. It says names and dates of birth were involved.
- 6
August 4, 2026 — New Breach Suit Filed
Perkins v. CommonSpirit Health, No. 1:26-cv-09254, is filed in Chicago. As of October 8, 2026 it is open with no settlement.
Three Things to Watch For
Two breach notices in 2026 and a big health-system name make CommonSpirit an easy hook:
“CommonSpirit MyChart settlement” claim pages
There is no CommonSpirit tracking case and no settlement of any kind. A page asking for your portal login or Social Security number to “file your claim” is collecting data.
Calls that quote your breach letter
Real notices list a Kroll call center number; MicroCode’s is 844-958-8933. Call the number printed on your own letter, never one given to you by a caller.
“Sign now to join the CommonSpirit class”
No class has been certified. A law-firm retainer is a real contract, not a registration form. Read it before you sign.
CommonSpirit Lawsuit — Questions People Actually Ask
Is there a CommonSpirit Health MyChart lawsuit?
Not that we could find as of October 8, 2026. We found no lawsuit alleging that CommonSpirit, or its MyChart-based patient portal, sent patient activity to Meta or Google. The open CommonSpirit case is a data breach suit.
What is the new CommonSpirit lawsuit?
Perkins v. CommonSpirit Health, No. 1:26-cv-09254, filed August 4, 2026 in the Northern District of Illinois before Judge Lindsay C. Jenkins. It attaches a breach notice letter. We have not confirmed which breach it concerns.
What happened to the 2022 ransomware lawsuits?
The lead Chicago case was dismissed for lack of standing on October 5, 2023. In the Colorado case, a magistrate judge recommended dismissal for lack of standing; the plaintiff objected on April 30, 2024, and the case was terminated on December 3, 2024. We did not find a payment to patients in either case.
Is there a CommonSpirit settlement or claim form?
No. There is no settlement, no fund, no administrator, no claim form and no deadline in any CommonSpirit privacy or breach case we found.
I got a CommonSpirit data breach letter in 2026. Which one?
Read the sender line. The Pinnacle notice concerns Pinnacle Holdings, a vendor of NorthGauge Healthcare Advisors (which serves CommonSpirit), and may include Social Security numbers and medical details. The MicroCode notice involves a malpractice-insurance database and, it says, names and dates of birth.
What is CommonSpirit’s patient portal called?
In Washington it is the CommonSpirit Patient Portal, powered by MyChart, which replaced MyVirginiaMason. Some Virginia Mason clinics use VMFH MyChart instead. Other CommonSpirit regions may use a different name.
Do I have to do anything now?
No. If a class is certified or a settlement is reached, class members are notified directly. Keep any breach letter you received.
What is worth doing right now?
If your letter lists your Social Security number, freeze your credit at all three bureaus. It is free and reversible. Enroll in the credit monitoring offered in the letter. Check insurer statements for care you never received.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
MyChart Class Action Claim Form
Which hospital tracking settlements have claim forms, and which closed
MyChart Settlement Calculator
What hospital pixel settlements have paid per patient
Data Breach Settlement Calculator
Estimate a healthcare breach payout from comparable cases
Open Class Action Settlements
Settlements still taking claims, with deadlines