University Hospitals, a nonprofit academic health system based in Cleveland, Ohio, detected unusual server activity on October 22, 2026. The organization took its digital services and systems offline to contain the incident and confirmed on October 26 that it was responding to a cybersecurity incident with the assistance of third-party computer forensics specialists and federal law enforcement.
As of late October 2026, University Hospitals had not confirmed whether patient data was actually accessed or exfiltrated, and no official notification letters had been issued. While a filed class action lawsuit alleged that names, Social Security numbers, dates of birth, addresses, and medical information might be involved, the health system has not validated those claims or publicly disclosed an official count of impacted individuals.
The full scope of the incident remains under active investigation. In cybersecurity investigations involving healthcare networks, technical analyses and forensic reviews often take time to identify the specific systems accessed and determine whether patient records were compromised.