St. Luke’s Medical Center said someone gained access without permission to a system used by its mobile app. The incident may have exposed personal information of some patients and employees.
An outside service provider manages the affected system. In its Oct. 30 notice, the hospital said it acted immediately after discovering the breach and asked independent cybersecurity experts to investigate.
“Upon discovery, we immediately implemented containment measures and engaged independent cybersecurity experts to investigate the incident,” St. Luke’s said in a statement.
The National Privacy Commission (NPC) received the hospital’s data breach report on Oct. 30, 2026, according to NPC Spokesperson and Deputy Privacy Commissioner Atty. Jose Belarmino II.
“The Commission is currently reviewing the notification in accordance with its established procedures for handling personal data breach notifications. At this stage, we are unable to disclose further details as the matter undergoes the Commission’s regular evaluation process,” Belarmino said.
The hospital’s notice did not name the service provider or say how many people may have been affected. It also did not say what personal information was involved or how the system was accessed.
St. Luke’s said it will contact people whose information may have been affected. Hospital services continue as usual.
“Hospital operations remain unaffected, and patient care continues to be our highest priority,” St. Luke’s said.
The hospital apologized for the concern caused by the incident and said it remains committed to protecting patients’ and employees’ personal information.
Image from St. Luke’s page