Skip to main content
Over a doctor’s shoulder we see a spreadsheet of medical data on a vulnerable hospital computer.

IU Health Data Breach Investigation

Written by Joseph Lyon on . Posted in Data Breach.

The data breach lawyers at The Lyon Firm are reviewing class action claims in relation to the security incident reported at IU Health. Impacted individuals and potential plaintiffs can contact our legal team to learn more about how to protect themselves from fraud risks and identity theft following a data theft event and to discuss the legal process of filing a class action claim.

Our attorneys have represented clients nationwide in a wide range of data privacy cases, and we take pride in fighting against entities with poor IT security systems that lead to data breach incidents. We think any company or hospital that collects and stores your personal data has a duty to protect it to the best of their ability. If sensitive information is leaked or stolen, you may be able to seek compensation and hold any negligent party accountable.

What Happened at IU Health?

IU Health began sending out data breach notification letters to affected individuals on December 17, 2024. Indiana University Health Affiliated Covered Entity (IU Health) announced last week that it had detected unusual activity associated with a user’s email account, which may have resulted in patient information being compromised. IU Health has reported that they are not currently aware of any financial or Social Security numbers impacted by this incident, however, the scope of the breach is still being investigated, and more details should emerge in the coming weeks.

As of writing, we do know that on October 18, 2024, Indiana University learned that a team member’s email account may have been hacked, which sparked an initial investigation into the incident with the assistance of an external forensics firm. It has been determined that an unauthorized individual did in fact access an IU Health email account between October 4-18, 2024, and may have obtained sensitive personal information. The information allegedly varies per individual, but may have included address, age, medical record number, diagnosis, or other health and treatment information.