IU Health Data Breach Compromises Medical Information

Indiana University Health Inc., the largest healthcare system in Indiana, disclosed a data breach involving its IT vendor, AME Group. The breach affected 2,080 individuals in the United States.

On Feb. 17, 2026, unauthorized access occurred through a previously unknown software vulnerability in the system managed by AME Group. Upon detecting the suspicious activity, AME Group initiated its incident response protocols.

An investigation into the breach found that unauthorized access to certain information had occurred. The affected data was limited to information related to a specific subset of Southern Indiana patients' radiology files within the Electronic Medical Record System.

The types of information exposed included names, dates of birth, health plan member identification numbers and other limited treatment information associated with an imaging center.

The breach was reported to the Indiana Attorney General on April 10, 2026. The company additionally posted a notice on its website about the incident. IU Health began notifying affected individuals on Sept. 29, 2026.

Indiana University Health's response to the breach

The company has set up a dedicated call center to answer questions from those who may be affected. The toll-free number is 888-763-1817, available from 9 a.m. to 5 p.m. Eastern Time, Monday through Friday, excluding major U.S. holidays.