August 14, 2026: Vanderbilt Health is notifying 3,298 patients that an attacker reached an employee's email account after the employee clicked a malicious link. Documents in the mailbox may have included names, medical record numbers, visit dates and diagnosis or procedure details. Social Security numbers and financial data were not involved. See the Vanderbilt Health breach record for the full details.
Vanderbilt Health is the Nashville academic health system that operates Vanderbilt University Medical Center (VUMC). Becker's Hospital Review reported the notice on August 14, 2026. The patient count comes from a filing with the HHS Office for Civil Rights, the federal agency that tracks health data breaches.
The health system says its electronic medical record system was not affected. The exposure was limited to files stored in one employee's mailbox.
What happened in the Vanderbilt Health data breach?
An employee clicked a link in a phishing email, which gave an unauthorized person access to that employee's mailbox. Vanderbilt Health discovered the access on March 27, 2026. Its investigation found that certain documents in the mailbox were accessed on March 23.
Patient letters went out by mail around August 14, almost five months after discovery. Gaps like this are common when a health system must review every file in a large inbox to find out whose data was there. Vanderbilt says it is tightening email security and expanding staff training.
What data was exposed?
According to the notice, the documents that may have been viewed included:
- Identity details: patient names and medical record numbers.
- Visit details: admission, discharge or visit dates.
- Clinical details: diagnosis or procedure information.
- Care team details: provider or facility names.
No Social Security numbers or financial information were involved, the health system said. That lowers the risk of credit fraud. A diagnosis paired with a real visit date is still useful to scammers, for example in a fake text saying a Vanderbilt bill is overdue.
Medical record numbers are internal hospital IDs. They let an impersonator sound like hospital staff, which makes phone and email scams more convincing.
Who is affected?
The 3,298 people receiving letters are current and former patients whose information was in that employee's inbox. Vanderbilt University students are not automatically included, and the notice does not mention staff files.
If you did not get a letter, you are probably not part of this group. You should still watch for phishing that uses Vanderbilt or VUMC branding and quotes this news.
Is this the same as the Vanderbilt University leak-site claims?
No. This notice is a confirmed phishing incident at the health system. Some 2026 leak-site posts name only "Vanderbilt EDU," and neither the university nor VUMC has matched those posts to this incident. The medical center and the university share a campus and a brand, but they are separate organizations.
Law firm pages about a "potential Vanderbilt University" breach do not refer to this federal filing. Rely on the letter you receive from Vanderbilt Health.
What should Vanderbilt Health patients do?
- Keep the letter if one arrives, and compare any later messages with it and with vanderbilthealth.com or vumc.org.
- Read your explanation-of-benefits statements and report any visit or procedure you do not recognize.
- Enroll in the free credit monitoring offered in the letter if you want it.
- Do not give a Medicare number, insurance card or date of birth to anyone who contacts you about "restoring your chart."
- If a caller already knows your last appointment, hang up and call the number on your paper after-visit summary.
Other recent healthcare notices show the range of risk. The Urologic Specialists of Oklahoma breach may have included Social Security numbers. The El Camino Health email breach also started with compromised mailboxes. Vanderbilt's other incidents are listed on the Vanderbilt Health company page.
Frequently asked questions
How many people were affected by the Vanderbilt Health breach?
Vanderbilt Health is notifying 3,298 patients, according to its notice and a filing with the HHS Office for Civil Rights reported in August 2026. These are current and former patients whose information was in documents stored in one employee's email account.
Were Social Security numbers stolen?
No. Vanderbilt Health said no Social Security numbers or financial information were involved. The documents may have included names, medical record numbers, visit dates, diagnosis or procedure details and provider or facility names. The health system is still offering free credit monitoring to people who receive a letter.
Was the Vanderbilt medical record system hacked?
No. Vanderbilt Health said its electronic medical record system was not affected. The attacker reached a single employee's mailbox after the employee clicked a malicious link. Only documents stored in that mailbox may have been viewed, and the health system says it is tightening its email security.
When did the Vanderbilt Health breach happen?
Documents in the mailbox were accessed on or about March 23, 2026. Vanderbilt Health discovered the access on March 27. After reviewing the mailbox contents, it began mailing letters to affected patients around August 14, 2026, almost five months after discovery.