2026 Vanderbilt Health — email phishing; 3,298 patients PHI
Data compromised
3,298 patients. Names, medical record numbers, admission, discharge or visit dates, diagnosis or procedure information, and provider or facility names may have been in mailbox attachments that were viewed. No Social Security numbers or financial information, Vanderbilt said. Complimentary credit monitoring offered.
Technical writeup
Census and field list from the health-system notice as reported by Becker’s on 14 August 2026, citing an HHS OCR filing. Catalogued under Vanderbilt Health, not the undergraduate university.
Root cause
An employee clicked a malicious link. Vanderbilt Health found on 27 March 2026 that an unauthorised person had reached that mailbox. Access to certain documents on 23 March. HHS OCR filing. Notices by mail around 14 August 2026. Electronic medical-record system not affected. Separate from unverified 2026 leak-site listings that name Vanderbilt EDU.