Skip to content
Breaches.

Indiana University Health

Disclosed Apr 17, 20233 years ago21,383 affectedConfirmed

Official notice

The covered entity (CE), Indiana University Health, reported that its business associate (BA) experienced a cybersecurity incident that affected the protected health information (PHI) of 4,194 individuals. The PHI involved included names and treatment information. The CE notified HHS, affected individuals, the media, and provided substitute notice. In response to the breach, the BA implemented additional technical and security safeguards to better protect PHI.

What is known

People affected21,383 (as reported to HHS)
DisclosedApr 17, 2023
HappenedJun 20, 2023
AttackHacking
Data exposedNames, Health
SectorHealthcare · US
StatusConfirmed

Sources

Source
Indiana Attorney General 2023 data breach report: Indiana University Healthin.gov · Official notice
HHS OCR breach report (archive, resolved): Indiana University Health (Healthcare Provider, IN)ocrportal.hhs.gov · Official notice

Notices filed

WhereFiledPeople
Indiana AGresidents of INApr 17, 20234
Indiana AGresidents of INJul 21, 20231
HHS archivetotalAug 4, 202321,383
HHS archivetotalAug 31, 20231,191
HHS archivetotalSep 22, 20234,194

Other breaches at Indiana University Health

BreachAffected
Disclosed Mar 13, 2026Mar 136 months ago3
Disclosed Apr 19, 2024Apr 19, 20242 years ago514
Disclosed Feb 10, 2022Feb 10, 20224 years ago1
Disclosed Apr 22, 2021Apr 22, 20215 years ago1
Disclosed Mar 9, 2020Mar 9, 20206 years ago1
Disclosed Dec 17, 2018Dec 17, 20187 years ago10
Disclosed Nov 3, 2017Nov 3, 20178 years agoLost or stolen device1,399
Disclosed Apr 14, 2017Apr 14, 20179 years ago1
History of this record
  • 2026-09-25 · records: 4194 to 21383 · backfill source
  • 2026-09-25 · attack: unknown to hacking · backfill source
  • 2026-09-25 · data_types: [] to ["names","health"] · backfill source
  • 2026-09-25 · records_basis: organization to hhs · backfill source
  • 2026-09-25 · records: 465 to 4194 · backfill source
  • 2026-09-25 · summary: empty to The covered entity (CE), Indiana University Health, reported that its business associate (BA) experienced a cybersecurity incident that affected the protected health information (PHI) of 4,194 individuals. The PHI involved included names an · backfill source
  • 2026-09-25 · records: 1 to 465 · backfill source
  • 2026-09-25 · disclosed: 2023-07-21 to 2023-04-17 · backfill source
  • 2026-09-25 · added · backfill source

First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.

Everything about Indiana University Health

New breaches by email

Wednesdays, only in weeks with newly disclosed breaches, the largest first.

Double opt-in. Unsubscribe any time.