Vanderbilt University Medical Center experienced a data incident around July 24, 2026, when an employee email account was compromised through a phishing attack. The incident was disclosed by Vanderbilt Health, and subsequently reported by various news outlets.
The breach involved patient names, medical record numbers, admission, discharge, and visit dates, diagnosis or procedure information, and provider or facility names. Social Security numbers and financial account information were not involved. A total of 3,298 patients were affected by this incident.
Public reporting indicates affected patients were being notified, and complimentary credit monitoring was offered. However, specific details such as the exact breach occurrence date or the date regulators were notified have not been publicly confirmed.