The AME Group Ransomware Attack Exposes IU Health Data

The AME Group (AME), an employee-owned managed IT services company headquartered in Vincennes, Indiana, was the target of a ransomware attack discovered in early August 2026.

The company provides IT support, cybersecurity, cloud services and other technology solutions to organizations in sectors including education, health care, manufacturing and business. At the time of the incident, the company was serving as an IT vendor for Indiana University Health Affiliated Covered Entity, commonly known as IU Health.

On Aug. 4, 2026, IU Health learned that AME may have been susceptible to a previously unknown software vulnerability.

On Aug. 5, 2026, the day after the breach was discovered, a report about the cyberattack appeared on the open web. The Vincennes Community School Corporation, another organization that utilizing AME's services, announced it had also been affected by the ransomware incident.

As a precautionary measure, the school district temporarily shut down its servers, which resulted in phone and internet outages across all of its school buildings. School officials stated that the district's own systems had not been compromised and that the shutdown was implemented solely as a preventive step while AME investigated and responded to the attack.

An investigation into the incident found that a certain contractor had limited access to information related to certain Southern Indiana patients' radiology files within their electronic health record.

The types of protected health information exposed included names, dates of birth, health plan member identification numbers and other limited treatment information associated with an imaging center.

IU Health began notifying affected individuals on Sept. 29, 2026, and posted a notice on its website with details about the incident.

AME's response to the breach

At this time, AME has not yet released a statement concerning the incident. Individuals who believe they may have been impacted but have not received a notification letter should reach out directly to the company for more information.

Because AME is a vendor, individuals who have not directly interacted with the company may have been impacted. It is important to remain vigilant and review accounts for any suspicious activity.

As more information is released, this article will be updated.