St. Luke’s Medical Center has disclosed a data security incident involving a platform supporting its eHealth Hub mobile application that may have exposed personal information belonging to some patients and employees.
The hospital said it detected unauthorized access to the platform on Oct. 29, 2026. The affected system was managed by a third-party service provider.
Following the discovery, St. Luke’s said it isolated and secured the affected platform and took the mobile application offline as part of its containment measures.
The hospital also engaged independent cybersecurity experts to conduct a forensic investigation and strengthen its security safeguards.
St. Luke’s maintained that its electronic medical records (EMR) and other core clinical systems were not affected by the incident.
The hospital has not disclosed the number of patients and employees potentially affected or the specific categories of personal information that may have been compromised.
It also has not identified the third-party service provider involved in managing the affected platform.
St. Luke’s said it would directly notify individuals whose personal information may have been involved in the incident.
Meanwhile, the National Privacy Commission (NPC) confirmed that it received a personal data breach notification from St. Luke’s on Oct. 30, 2026.
NPC spokesperson and deputy privacy commissioner Jose Belarmino II said the agency is evaluating the notification under its established procedures.
“The Commission is currently reviewing the notification in accordance with its established procedures for handling personal data breach notifications,” Belarmino said.
“At this stage, we are unable to disclose further details as the matter undergoes the Commission’s regular evaluation process,” he added.
The NPC has not disclosed whether the incident involved sensitive personal information or how many individuals may have been affected.
The hospital has also not announced the results of its forensic investigation or a timeline for restoring the affected mobile application.
The incident remains under review by the NPC.
