Vanderbilt Health Data Breach Compromises Patient Information

Vanderbilt Health, a large nonprofit academic health system based in Nashville, Tennessee, disclosed a data security incident that affected patients.

Vanderbilt Health is the clinical brand name for Vanderbilt University Medical Center, one of the largest academic medical centers in the Southeast.

According to a disclosure dated July 24, 2026, the incident began when a Vanderbilt Health employee clicked a malicious link contained in a message. Clicking the link gave an unauthorized individual access to the employee's email account on March 23, 2026.

Vanderbilt Health discovered the compromised email account four days later, on March 27, 2026, and launched an investigation to determine the full scope of the incident.

The investigation took approximately two months to complete and found evidence that the unauthorized person had not only accessed certain documents within the email account but may have also viewed email attachments that contained patient information.

The company emphasized that this data security incident did not involve Vanderbilt Health's electronic medical record system and was limited to information found within the compromised email account and its attachments.

The types of protected health information that may have been improperly accessed included patient names, medical record numbers, admission, discharge or visit dates, diagnosis or procedure information and provider or facility names. According to the company's statement, no Social Security numbers or financial account information were involved in the incident.

Separately, a threat actor known as ZanzxyyXploit posted a claim on the open web on June 27, 2026, stating that it had defaced the website of Vanderbilt University.

Vanderbilt Health's response to the breach

Vanderbilt Health is providing affected patients with details about what occurred and what steps they can take. The organization is also offering complimentary credit monitoring services to those impacted as a precautionary measure.

The Vanderbilt Health Privacy Office is available to answer questions and provide guidance to those who may have been affected. Individuals can reach the office at 615-936-3594 or by email at vumcprivacyoffice@vumc.org.