Eskenazi Health Data Breach Exposes Sensitive Personal and Medical Info

Eskenazi Health , a public safety-net health system in Indianapolis, disclosed a data breach involving unauthorized access to an employee's cloud-based work account.

The health system posted a notice the security incident on its website , stating it is leading the investigation on behalf of the Health & Hospital Corporation of Marion County and its divisions.

The breach resulted from a phishing attack that compromised an employee's cloud-based work account. The email account of a trusted business had first been compromised by an unauthorized individual. The individual then used the compromised 's account to send thousands of unauthorized emails to people in the 's address book, including an Eskenazi Health employee.

Because the phishing email appeared to come from a known and trusted , the employee did not recognize it as suspicious. The email contained a link tied to what appeared to be a secure document notification. After the employee clicked the link and completed the requested authentication process, the unauthorized individual gained access to the employee's cloud-based work account.

The forensic investigation determined that the unauthorized access began on June 1, 2026, and continued until July 27, 2026. On that date, Eskenazi Health discovered the suspicious activity and cut off the unauthorized access.

A review of the affected email account found that it contained patient information.

The types of personally identifiable information exposed included personal demographic and information, Social Security numbers and Eskenazi Health internal identifiers such as medical record numbers.

The types of protected health information exposed included health insurance and billing information, medical and treatment information and sensitive health information such as substance use disorder diagnosis and treatment records.

Eskenazi Health's response to the breach

Eskenazi Health's response to the breach

Eskenazi Health has notified affected individuals and is offering identity protection services, including credit monitoring, at no cost. Instructions on how to enroll in the identity theft protection program are included in the notification letters sent to those affected.

Individuals with questions the incident can call 833-919-4281, Monday through Friday, 9 a.m. to 9 p.m. EST.

SUBMIT YOUR CLAIM TO THE LAW FIRM HANDLING THIS INVESTIGATION

Social Security Numbers

Affected information types not yet disclosed