Indiana University Health Affiliated Covered Entity (IU Health) said last week that it detected unusual activity linked to a team member's email account, which resulted in some information being compromised, specifically a limited number of Social Security numbers.

The cyberattack was discovered on November 8, at which point UI Health began investigating the incident, taking steps to protect its systems and protect the user's accounts. 

As part of that effort, an external forensics firm was tapped to conduct an independent review to confirm the security of the account and to help determine what, if any, information may have been impacted.

According to the investigation, an unauthorized recipient had access to the team member's email account between August 27 and October 2, 2024, and may have obtained "certain information," said IU Health.

WHAT'S THE IMPACT

The information involved varied per individual, but may have included address, age, medical record number, diagnosis and other limited treatment information.

The Social Security numbers of a limited number of people were exposed during the incident, the investigation found. Those whose Social Security numbers were impacted will be offered 12-months of credit monitoring, said IU Health.

The organization began notifying affected individuals on January 2 and is providing dedicated call center support to answer any questions.

"We are committed to protecting personal information, and IU Health continues to implement security measures to prevent these activities from occurring in the future," IU Health wrote.

THE LARGER TREND

A number of cyberattacks have affected healthcare organizations in recent years. The most notable cyberattack of 2024 was the one that targeted Change Healthcare, which according to the HIPAA Journal, compromised the protected health information of at least 100 million people.

This represents a third of the population in the United States and makes the data breach the largest known breach at a HIPAA-regulated entity. The previous record was set by Anthem in 2015 in an attack affecting 78.8 million individuals, the report said.

Nonprofit health system Ascension was hit by a ransomware attack in May 2024, with a report to federal regulators showing that about 5.6 million people were affected. 

A June 2024 KnowBe4 report showed the global healthcare sector experienced 1,613 cyberattacks per week in the first three quarters of 2023, nearly four times the global average, and a significant increase from the same period the previous year. This surge has contributed to a steep rise in cyberattack costs for healthcare organizations, with the average breach cost nearing $11 million – more than three times the global average – making healthcare the costliest sector for cyberattacks.

Ransomware attacks have dominated, accounting for over 70% of successful cyberattacks on healthcare organizations in the past two years.

IU Health says data compromised in cyberattack

IU Health Affiliated Covered Entity detected a cyberattack on November 8, 2024, resulting in the compromise of some information, including a limited number of Social Security numbers, belonging to a team member's email account. The attack occurred between August 27 and October 2, 2024. IU Health began investigating and notified affected individuals on January 2, 2025, offering credit monitoring for those whose Social Security numbers were impacted.