IU Health Reports Security Incident

Indiana University Health Affiliated Covered Entity (IU Health) announced that it detected unusual activity associated with a user’s email account resulting in limited information being compromised. A limited number of Social Security numbers were impacted by this incident.

On November 8, 2024, we learned that an IU Health team member’s account may have been compromised. On the same day, IU Health began investigating the incident and took steps to protect the user’s accounts and our systems. Additionally, an external forensics firm was engaged to conduct an independent review to confirm the security of the account and to help determine what, if any, information may have been impacted. The investigation determined that an unauthorized recipient had access to the team member’s email account between August 27 and October 2, 2024, and may have obtained certain information.

The information involved varied per individual, but may have included address, age, medical record number, diagnosis, or other limited treatment information. For a limited number of affected individuals, Social Security numbers were impacted by this incident. The individuals whose Social Security numbers were impacted will be offered 12-months of credit monitoring.

IU Health began notifying affected individuals on January 2, 2025, and is providing dedicated call center support to answer any questions. We are committed to protecting personal information, and IU Health continues to implement security measures to prevent these activities from occurring in the future.