IU Health, the Indiana health system, announced that a vendor’s legacy system was accessed without authorization, exposing limited radiology information for certain Southern Indiana patients. Breach trackers list 2,080 affected individuals.
IU Health’s Data Breach Investigation
IU Health is the name used by Indiana University Health Affiliated Covered Entity, a large health system based in Indianapolis, Indiana. In a news release, the health system said that a vendor, AME Group, which provided information technology services for an isolated IU Health legacy system, may have been susceptible to a previously unknown software vulnerability.
According to that announcement, IU Health learned of the issue on August 4, 2026. It said it took steps to verify the security of its own systems and carried out an independent review of the external system managed by the vendor. That review found unauthorized access to limited imaging center information related to certain Southern Indiana patients’ radiology files that were stored on the legacy system.
IU Health stated that there is no evidence its network or core systems were affected, and that there was no access to its electronic medical record system. It also said patient care was not affected. These statements come from the health system itself, and this page reports them as the organization’s own account rather than as independently confirmed findings.
The announcement does not say how many people were affected. Breach trackers that summarize regulatory filings, including HIPAA Journal and ClaimDepot, list 2,080 individuals for this incident. This page relies on that tracker figure and notes that IU Health’s own announcement does not state a number. The sources reviewed also do not say which imaging centers were involved, when the unauthorized access took place, or how long it lasted. One tracker gives a different date for the access than the other sources do, and because that date is not supported by IU Health’s announcement, this page does not repeat it.
The incident involves a third-party vendor, which is a common pattern in healthcare. Hospitals and clinics rely on outside companies to run billing, imaging, records and hosting systems, and an older legacy system managed by a vendor can be harder to keep patched than current systems. This is general context about the healthcare sector, not a statement about how the vendor’s system was reached here.
Radiology and imaging records can reveal the reason a person sought care, the part of the body examined and the identity of the ordering physician. Even when the data is described as limited, a combination of a name, a date of birth and an insurance member number is enough for someone to attempt to bill an insurer for services a patient never received or to make a convincing scam call.
Anyone who received a notice letter from IU Health should read it closely. The letter is the best source for what happened in your case, what information of yours was involved, and what support, if any, is being offered. Keep the letter, the envelope and any instructions in a safe place.
Federal rules generally require a covered entity to notify affected individuals without unreasonable delay after discovering a breach. Notices that arrive weeks after an incident is discovered are common, and a notice is not by itself a finding about fault or about whether safeguards were adequate. Those questions remain open on the public record, and they are the kind of questions attorneys can ask on behalf of people who were harmed.
When Did This Breach Occur?
IU Health said it learned on August 4, 2026 that its vendor may have been susceptible to the software vulnerability. It began notifying affected individuals on September 29, 2026, the same day it issued its news release.
The sources reviewed do not state when the unauthorized access itself occurred. If you received a letter, its own dates and description are the most reliable record of the timeline for your information.
What Information Was Breached?
IU Health said the information involved varied by individual but may have included name, date of birth, health plan member identification number, and other limited treatment information associated with the imaging center. The announcement did not list Social Security numbers or financial account information.
The notice letter you receive should state which of your details were involved. Until then, it is prudent to treat your insurance member number and any imaging-related details as potentially at risk.
What You Can Do
If you received a notice related to IU Health or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Contact your health plan, explain that your member ID may have been exposed, and ask whether a new ID number can be issued. Review insurance statements and explanation of benefits notices for care you did not receive.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against IU Health
If you received a notice about this incident, or believe your personal or health information was exposed, you may have legal options. Healthcare organizations are expected to safeguard the sensitive information entrusted to them, including when a vendor handles it, and a class action can help hold them accountable when they fail to do so.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
