On or about February 19, 2026, Spokane Digestive Disease Center, P.S. (“SDDC”) became aware of suspicious activity involving an employee email account. According to the Notice of Data Event, SDDC promptly took steps to secure its email environment, initiated an internal investigation, and began assessing the nature and scope of the activity.
Following the initial investigation, SDDC confirmed on May 8, 2026, that certain patient information may have been impacted. The forensic review later determined that emails and attachments were accessed without authorization between January 22, 2026 and February 18, 2026. Because of the volume of data involved, it was not until May 2026 that SDDC identified affected individuals and determined there was sufficient information to issue notification letters.
After identifying the affected information, SDDC worked to resecure its systems and strengthen its overall security posture, including implementing additional safeguards and employee training.
Spokane Digestive Disease Center, P.S. is a Washington-based healthcare provider specializing in digestive health and gastrointestinal medical services.
SDDC also stated that, at the time of notification, it had not received reports of identity theft or fraud resulting from the incident. However, the investigation confirmed that unauthorized access to sensitive information may have occurred.
Affected individuals began receiving written notification letters on May 26, 2026. If you received a Notice of Data Event from SDDC, it confirms that your personal and/or medical information may have been involved in the incident.
As part of its response, SDDC is offering affected individuals complimentary credit monitoring and identity protection services through Experian for one year.
What information is involved in the Spokane Digestive Disease Center Data Breach?
Compromised information may include:
First Name
Last Name
Social Security Number
Date of Birth
Driver’s License or State ID Number
Financial Account and Credit Card Information
Electronic Signature
Medical Information
The specific data elements involved vary by individual and are detailed in each notification letter sent by Spokane Digestive Disease Center.
Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.
Much of the information involved in this incident may also qualify as Protected Health Information (PHI). PHI includes medical or healthcare-related data protected under federal and state privacy laws. When PHI is compromised, it can be misused for medical identity theft or insurance fraud.
If your information was involved in this incident, it is important to remain vigilant. Individuals are encouraged to monitor financial accounts, review medical and insurance statements, and follow the protective steps outlined in the notification letter.
Patients and consumers may have legal rights when companies that handle sensitive medical data fail to adequately protect it.
If you received a Notice of Data Event related to the Spokane Digestive Disease Center, P.S. incident, your personal and potentially health-related information may be at risk.
Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review.