UChicago Medicine Medical Group
Disclosed May 23, 20251 year ago38,656 affectedConfirmed
The covered entity (CE), UChicago Medicine Medical Group, reported that it was the subject of a cybersecurity incident that affected the protected health information of 38,656 individuals. The PHI involved included names, Social Security numbers, addresses, dates of birth, claims information, diagnoses/conditions, and treatment information. The CE notified HHS, the affected individuals and the media. In response to the breach, the CE provided complimentary credit monitoring services to the affected individuals and implemented additional administrative, technical, and security safeguards to better protect its PHI.
What is known
| People affected | 38,656 (as reported by the organization) |
|---|---|
| Disclosed | May 23, 2025 |
| Happened | Jul 5, 2024 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Indiana Attorney General 2025 data breach report: UChicago Medicine Medical Groupin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): UChicago Medicine Medical Group (Healthcare Provider, IL)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | May 23, 2025 | 1,694 |
| HHS archivetotal | May 23, 2025 | 38,656 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), UChicago Medicine Medical Group, reported that it was the subject of a cybersecurity incident that affected the protected health information of 38,656 individuals. The PHI involved included names, Social Security nu · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.