Eskenazi Health discloses phishing-related breach of Social Security, medical data

Eskenazi Health, a public safety-net health system in Indianapolis, disclosed a data breach that exposed patients’ Social Security numbers and medical information after a phishing attack gave an unauthorized individual access to an employee’s cloud-based work account.

According to the health system, the breach began when a trusted business contact’s email account was compromised and used to send thousands of unauthorized emails to people in the contact’s address book, including an Eskenazi Health employee. Because the message appeared to come from a known contact, the employee did not recognize it as suspicious, clicked a link presented as a secure document notification and completed the requested authentication process, giving the attacker access to the employee’s work account.

A forensic investigation found that the unauthorized access began around June 1, 2026, and continued until July 27, 2026, when Eskenazi Health discovered the suspicious activity and cut off access. A review of the affected account found it contained patient information, and the health system said the unauthorized individual may have accessed emails and attachments with sensitive data during that period.

The exposed information included names and other demographic or contact information, Social Security numbers, internal Eskenazi Health identifiers such as medical record numbers, health insurance and billing information, medical and treatment records, and sensitive health information including substance use disorder diagnosis and treatment records. The health system said the specific information affected varied by individual.

Eskenazi Health, the public hospital division of the Health & Hospital Corporation of Marion County, said it is leading the investigation on behalf of the corporation and its divisions. The health system said it has secured the affected account, implemented additional safeguards and is evaluating enhanced security controls and employee training to reduce the risk of similar incidents.

Eskenazi Health has begun notifying affected individuals and is offering identity protection services, including credit monitoring, at no cost; enrollment instructions are included in the notification letters. Individuals with questions can contact the health system’s response center at 833-919-4281, Monday through Friday from 9 a.m. to 9 p.m. Eastern time, or reach Equifax, Experian and TransUnion directly to review their credit files for suspicious activity.

Shamis & Gentile, a law firm specializing in data breach class actions, said it is investigating the Eskenazi Health breach.