University Hospitals, the academic health system based in Cleveland, Ohio, disconnected its systems from the internet in late October 2026 after spotting unusual activity on its servers. The outage has disrupted its MyChart patient portal and other digital services, and a patient has already filed a proposed class action over the incident.
What follows is based on public statements and news coverage. The health system’s investigation is still underway, so the facts below may change.
University Hospitals’s Data Breach Investigation
University Hospitals detected unusual activity on its servers on Thursday, October 22, 2026. As a precaution, the health system disconnected its systems from the internet. A spokesperson told local reporters the next day that digital disruptions could continue for several days, and that there was no impact on the delivery of patient care at that point. The statement did not list every affected service and did not say whether patient information had been accessed.
The effects were visible to patients almost immediately. The MyChart patient portal went offline, the health system’s websites displayed a notice that only limited services were available, some locations had trouble connecting to the network, and insurance preauthorizations were affected. Some appointments and elective procedures were rescheduled. On October 26, 2026, University Hospitals publicly confirmed that it had experienced a cybersecurity incident and said it had made significant progress restoring systems over the weekend, while warning that challenges would likely last through the week. By October 29, 2026, news outlets were still reporting that most of the system’s websites remained down.
In an update on October 28, 2026, the health system said the vast majority of appointments and procedures were continuing as normal, that it was working to restore MyChart access, and that patients should keep their scheduled appointments unless their care teams contact them. University Hospitals says it is investigating with outside experts and is in communication with law enforcement. It has not disclosed what caused the incident, how far it reached, or whether any patient data was copied or taken.
Reporters have also noted that Quest Diagnostics, which provides outpatient laboratory services at University Hospitals locations, disclosed its own cybersecurity incident during the same week. University Hospitals has not said whether the two events are connected, and no connection has been confirmed.
On October 28, 2026, a University Hospitals patient filed a proposed class action in the U.S. District Court for the Northern District of Ohio. The complaint alleges that sensitive patient information was stolen during the incident, that the health system failed to use adequate cybersecurity protections such as multifactor authentication, and that it had not begun notifying affected people when the case was filed. The complaint also alleges that the patient received spam calls from people who knew her name and asked her to confirm personal details. Those are allegations in a court filing. They have not been proven, and University Hospitals has not confirmed that patient data was compromised. The complaint describes the number of affected patients inconsistently, and the health system has not confirmed any figure.
It helps to separate two things. A cybersecurity incident that takes systems offline is not automatically a data breach. A breach is established when an investigation finds that personal or health information was actually accessed or acquired. Until University Hospitals completes its review, the scope of any exposure is unknown. Federal and state breach notification rules generally require a covered organization to notify affected individuals without unreasonable delay once it determines that protected health information was compromised, so the first official word on exposure is likely to arrive by mail rather than through a press release.
Hospitals and health systems are frequent targets for attackers because their records combine identity details, insurance information, and medical history in a single file, and because a shutdown of clinical systems puts pressure on an organization to restore operations quickly. A large system that treats patients across many locations also has many connected vendors and devices, which widens the surface an attacker can try to reach. None of this is evidence about what happened at University Hospitals specifically. It is background on why incidents like this one draw close attention from patients and regulators alike.
If you are a current or former University Hospitals patient, the safest approach is to treat the situation as unresolved. Watch for a notice from the health system, use its official website and phone numbers rather than links in unsolicited messages, and keep a record of anything unusual that happens to your accounts, credit, or health insurance in the coming weeks.
When Did This Breach Occur?
University Hospitals says it detected unusual activity on its servers on October 22, 2026, and disconnected its systems from the internet in response. The health system publicly confirmed a cybersecurity incident on October 26, 2026, and issued a further update on October 28, 2026. A proposed class action over the incident was filed the same day.
The health system has not said when the unauthorized activity began, how long it lasted, or whether any data was accessed before systems were taken offline. Those details are expected to come out of the investigation. As of the latest reports, affected patients had not yet received breach notices.
What Information Was Breached?
University Hospitals has not confirmed what information, if any, was exposed, and has not said whether patient records were accessed.
The proposed class action alleges that the information potentially compromised includes names, Social Security numbers, dates of birth, addresses, health insurance information, medication information, and treatment information. That list comes from the complaint, not from the health system, and it has not been verified.
Information of this kind matters because it can be used for identity theft, fraudulent insurance claims, and convincing phone or email scams. Medical details are especially sensitive because they cannot be changed the way a password can.
What You Can Do
You do not need to wait for a notice to take sensible precautions.
- Keep your scheduled appointments unless your care team contacts you, and use University Hospitals’ official website or phone numbers to reach the health system.
- Be careful with calls, texts, and emails that mention the incident, MyChart, or your account, even if the caller knows your name. Do not give out your date of birth, Social Security number, or insurance details to someone who contacted you first.
- Review the explanation of benefits statements from your health insurer and report any services you do not recognize.
- Request your free credit reports from Equifax, Experian, and TransUnion at annualcreditreport.com and look for accounts or inquiries you did not authorize.
- Consider placing a free fraud alert or security freeze with each of the three credit bureaus.
- Report suspected identity theft to the Federal Trade Commission at IdentityTheft.gov and to your state attorney general.
File a Data Breach Lawsuit Against University Hospitals
Patients whose information is exposed in a health system incident may have legal options, especially if the organization failed to use reasonable safeguards or was slow to notify them. Whether a claim exists here depends on what the investigation finds.
If you receive a notice from University Hospitals, or you believe you were affected, keep the notice and any records of suspicious activity, fraud, or time and money spent dealing with the fallout.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
