IU Health reports security incident

INDIANAPOLIS -- Indiana University Health Affiliated Covered Entity (IU Health) announced today that it detected unusual activity associated with a user’s email account resulting in limited information being compromised. We are not aware of any financial or Social Security numbers impacted by this incident.

On October 18, 2024, we learned that an IU Health team member’s account may have been compromised. On the same day, IU Health began investigating the incident and took steps to protect the user’s accounts and our systems. Additionally, an external forensics firm was engaged to conduct an independent review to confirm the security of the account and to help determine what, if any, information may have been impacted. The investigation determined that an unauthorized recipient had access to the team member’s email account between October 4-18, 2024, and may have obtained certain information.

The information involved varied per individual, but may have included address, age, medical record number, diagnosis, or other limited treatment information. While there was no financial information or Social Security numbers impacted by this incident, as a precaution, we encourage affected individuals to remain vigilant and verify that anyone who is reaching out about personal and/or health information is a legitimate representative of the organization they say they are associated with.

IU Health began notifying affected individuals on December 17, 2024, and is providing dedicated call center support to answer any questions. We are committed to protecting personal information, and IU Health continues to implement security measures to prevent these activities from occurring in the future.

If you have any questions, please call toll-free at 1-844-920-8857, 9:00 a.m. to 9:00 p.m. Eastern Time, Monday-Friday (except major U.S. holidays).