On August 4, 2026, The AME Group, an IT managed services provider headquartered in Vincennes, Indiana, discovered suspicious activity involving an isolated legacy system it managed for Indiana University Health. A ransomware group reportedly targeted the system through a software vulnerability, gaining unauthorized access to specific patient files. IU Health reported that its core networks and primary electronic medical records were unaffected by the incident.
The breach compromised information belonging to 2,080 individuals connected to imaging center services in Southern Indiana. Exposed data types included patient names, dates of birth, health plan member identification numbers, and limited treatment information related to radiology records. There is no evidence indicating that Social Security numbers or financial account details were accessed.
Notifications to affected individuals began on September 29, 2026. While third-party law firms have announced inquiries into the security incident, official public disclosures remain focused on the Southern Indiana patient population, and further details regarding broader impacts have not been published.