The University of Illinois Chicago College of Medicine told people that a ransomware attack discovered on August 24, 2026 may have exposed medical record numbers, diagnoses, treatment details and billing history.
UIC College of Medicine’s Data Breach Investigation
The University of Illinois Chicago (UIC) College of Medicine, part of the University of Illinois System, sent a notice letter dated October 29, 2026 and filed a sample with Massachusetts regulators. The letter says UIC discovered a ransomware attack on August 24, 2026 that affected parts of the College of Medicine network. Massachusetts breach records list 4 Massachusetts residents, and the university has not published a total number of people affected across all states.
The letter says the investigation, run with cybersecurity experts, determined that unauthorized individuals accessed College of Medicine servers on August 24, 2026 and may have obtained some of the data stored there. The university says it isolated the affected systems and began investigating, then reviewed the affected files to work out what information they held and which individuals were involved. On September 21, 2026, it determined that information related to the recipient was contained in files involved in the incident.
In response, the university says it contained the incident and built new systems with additional security controls to reduce the risk of a similar incident. It also says it notified law enforcement and engaged IDX, a company that specializes in identity protection and recovery, to review the potentially compromised data and notify potentially impacted individuals. The letter is signed by the University of Illinois System HIPAA Privacy and Security Office.
The university is offering 12 months of complimentary identity protection services through IDX. The letter describes credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy and fully managed identity theft recovery services. People need an enrollment code from their own letter to sign up, and the letter lists an enrollment deadline in January 2027. The letter points out that the credit monitoring must be activated to work.
The information named in the notice goes beyond the usual financial identifiers. Medical record numbers, diagnoses, treatment or procedure details and billing history are health information, and exposure of those details can lead to medical identity theft, insurance fraud, targeted scams that use real treatment details, and personal embarrassment or harm. Health data cannot be changed after it is exposed, so the risk can last for a long time.
Ransomware attacks on universities and medical schools are common because they hold large research, clinical and administrative systems. In many such attacks, criminals copy files before encrypting systems, which is why a notice may say data may have been obtained even when operations were restored. The letter itself says only that unauthorized individuals may have obtained some of the data; it does not say whether any data has been published or who was responsible.
Attorneys are looking into whether the University of Illinois took reasonable steps to protect the health and personal information in its care and whether its notice met the standards that apply. The filed letter is a sample with the recipient’s name and address left as placeholders, so it does not show how many people received it or when each state’s notices were mailed.
When Did This Breach Occur?
According to the notice, UIC discovered a ransomware attack on August 24, 2026, and unauthorized individuals accessed College of Medicine servers on August 24, 2026. On September 21, 2026, the university determined that information related to the recipient was contained in the files involved. The notice letter is dated October 29, 2026.
What Information Was Breached?
The letter says the information relating to the recipient potentially includes full name, date of birth, mailing address, medical record number, diagnosis, treatment or procedure, study dates of service and billing history. Not every person may have every item, so your own letter is the best guide to what applies to you.
What You Can Do
If you received a notice from the UIC College of Medicine or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with the enrollment code for the IDX identity protection service.
- Enroll in the 12 months of IDX services before the deadline in your letter, and activate the credit monitoring so it takes effect.
- Review explanation-of-benefits statements and medical bills for services you did not receive, and report anything unfamiliar to your insurer.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Be skeptical of unexpected calls, texts or emails that mention the incident or your care, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against UIC College of Medicine
If you received a notice from the UIC College of Medicine, or you believe your health or personal information was involved in this ransomware attack, you may have legal options for holding the university accountable for how it protected your data.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
