Eskenazi Health Announces Notice of Data Breach Incident
Indianapolis, Sept. 25, 2026 -- Eskenazi Health has announced a security incident that resulted in the unauthorized access of some of its patient’s electronic health information. Eskenazi Health, a public hospital division of the Health & Hospital Corporation of Marion County (HHC), is leading the investigation on behalf of HHC and its divisions.
Security Incident – What Happened?
On July 27, 2026, Eskenazi Health discovered that an unauthorized individual gained access to an employee’s cloud-based work account. Upon discovering the unauthorized access, Eskenazi Health promptly began investigating and took steps to secure the account and protect its information systems.
The subsequent forensic investigation determined that the email account of a trusted business contact had been compromised and used to send thousands of unauthorized emails to individuals in its address book, including the Eskenazi Health employee. When the employee received the phishing email, it appeared to come from the trusted business contact and contained a link associated with a “secure” document notification. After the employee interacted with the link and completed the requested authentication process, the unauthorized individual gained access to the employee's work account.
The investigation determined that the unauthorized access began on June 3, 2026, and continued until July 27, 2026, when Eskenazi Health terminated the unauthorized access. The forensic review also found that the unauthorized individual may have accessed certain emails and attachments stored within the account during that time. As a part of its ongoing response, Eskenazi Health further secured the account, implemented additional protective measures, and conducted a review to determine the scope of information that may have been affected.
Eskenazi Health’s Response
Eskenazi Health takes the privacy and security of patient information seriously. Upon being alerted to the suspicious activity, we took steps to secure the affected employee account and investigate the nature and scope of the incident. We also conducted a review of the account to determine the individuals impacted and the information involved.
In response to the incident, Eskenazi Health has implemented additional safeguards and we are evaluating enhanced security controls and employee education to help reduce the risk of similar incidents in the future. We will continue to assess and strengthen our administrative and technical safeguards to protect patient information. As an added precaution, we are offering identity protection services to impacted individuals.
The Information Affected
Eskenazi Health conducted a review of the affected email account to determine whether patient information was contained within any of the emails and attachments and to identify the individuals whose information may have been involved. The information impacted varied by individual and may have included one or more of the following: personal demographic and contact information, health insurance and billing information, Eskenazi Health internal identifiers (e.g., medical record number), medical and treatment information, sensitive health information (e.g., substance use disorder diagnosis and treatment information), and Social Security number.
Impacted Individuals
Impacted individuals, or their loved ones, may wish to review information maintained by each of the credit reporting bureaus and any applicable financial institutions to detect any suspicious activity.
Contact the credit bureaus at the following numbers:
- Equifax 800-525-6285
- Experian 888-397-3742
- Trans Union 800-680-7289
Identity theft protection, including credit monitoring, is available for impacted individuals at no cost to them. Instructions on how to enroll in the identity theft protection program will be included in each impacted individual’s letter. If Eskenazi Health becomes aware of any additional material information, it will make such information available via its incident website, located here: https://www.eskenazihealth.edu/news/security-incident.
If you have additional questions following this incident, please contact 833-918-4281, Monday - Friday, 9 am - 9 pm EST. Please be prepared to provide Engagement Number B172612 when speaking with a representative.
Press inquiries should be directed to:
Michelle O’Keefe
Eskenazi Health Public Affairs & Communications
Michelle.Okeefe@eskenazihealth.edu
317-402-9327
About Eskenazi Health
For more than 165 years, Eskenazi Health has provided high-quality, cost-effective, patient-centered health care to Central Indiana. Accredited by The Joint Commission, nationally recognized programs include a Level I trauma center, regional burn center, comprehensive senior care program, women’s and children’s services, teen and adolescent care programs, Lifestyle Health & Wellness Center, Sandra Eskenazi Mental Health Center, and a network of primary care sites located throughout the neighborhoods of Indianapolis known as Eskenazi Health Center. Eskenazi Health also serves as the sponsoring hospital for Indianapolis Emergency Medical Services. As the public hospital division of the Health & Hospital Corporation of Marion County, Eskenazi Health partners with the Indiana University School of Medicine whose physicians provide a comprehensive range of primary and specialty care services. In 2013, the Sidney & Lois Eskenazi Hospital opened, providing a new modern and efficient facility and becoming Central Indiana’s first Leadership in Energy and Environmental Design (LEED®) Gold health care campus. Eskenazi Health has been named one of Becker’s Hospital Review’s “150 Top Places to Work in Healthcare” for the past four consecutive years.