Almeida Law Group is investigating a data breach at Deaconess Health System. The breach occurred on December 2nd–18th, 2025 and was discovered on June 26th, 2026. If you were affected, contact Almeida Law Group.
About Deaconess Health System
Deaconess Health System is a nonprofit healthcare network headquartered in Evansville, Indiana. Founded in 1892, it is the largest healthcare provider in the Illinois-Indiana-Kentucky tri-state area, serving more than 1.5 million residents across 22 hospital locations and more than 150 care sites, including hospitals, clinics, urgent care facilities, and a freestanding cancer center. Because Deaconess provides direct medical care to a large regional population, it maintains extensive records containing sensitive personal, financial, and health information about patients.
What Happened?
Deaconess Health System was listed in a Texas Attorney General data security breach report (record BR-0005228). According to that filing, a breach occurred between December 2nd, 2025 and December 18th, 2025 and was not discovered until June 26th, 2026—roughly six months later. The incident affected 203,874 individuals in total. Deaconess notified affected consumers by U.S. Mail. The compromised information included names, Social Security numbers, driver’s license numbers, medical information, health insurance information, and dates of birth.
This filing appears to be a separate and much larger incident than a previously disclosed breach involving Deaconess’s Release of Information vendor, MediCopy (owned by MRO Corp). In that earlier incident, an unauthorized actor accessed MediCopy’s cloud-based file-sharing platform on January 13th, 2026, affecting 8,941 individuals at two Deaconess hospitals in Kentucky. Deaconess stated at the time that the MediCopy incident did not affect its internal IT systems or electronic medical records. Separately, on April 8th, 2026, the ransomware group “Worldleaks” publicly claimed responsibility for a cyberattack against Deaconess Health System on its leak site, with Ransomware.live listing an estimated attack date of January 7th, 2026. These are unverified attacker-side allegations—Deaconess has not publicly confirmed a ransomware attack or any connection between the Worldleaks claim and the breach reported to the Texas Attorney General. At least three law firms—Lynch Carpenter, LLP, Goldenberg Schneider, LPA, and Zacks Law Group—have announced investigations into potential class action claims related to Deaconess data breach incidents, though no filed lawsuit has been identified.
Key Facts at a Glance
- Company or Organization: Deaconess Health System
- Industry: Healthcare – Medical Provider (nonprofit hospital/health system)
- Location: Evansville, Indiana
- Incident type: Data breach (unauthorized access to personal and health information)
- Date of breach: December 2nd, 2025 – December 18th, 2025
- Date breach discovered: June 26th, 2026
- Date of consumer notification: August 7th, 2026
- Total persons affected: 203,874
- Prior breach: Yes — separate MediCopy vendor breach disclosed March 2026, affecting 8,941 individuals at two Deaconess Kentucky hospitals
- Litigation status: Law firm investigations announced by Lynch Carpenter, LLP (March 23rd, 2026), Goldenberg Schneider, LPA, and Zacks Law Group; no filed class action identified as of research date
- Source: Texas Attorney General data security breach report (BR-0005228), oag.my.site.com; supplemental sources: hipaajournal.com; ransomware.live; dexpose.io; globenewswire.com
What Should You Do?
If you received a notice from Deaconess Health System, take steps now to protect yourself. Enroll in any identity theft protection service that Deaconess is offering, and pay attention to the enrollment deadline in your notice. Because Social Security numbers, driver’s license numbers, and health insurance information were involved, consider placing a fraud alert or credit freeze with each of the three major credit bureaus—Equifax, Experian, and TransUnion. Review your credit reports at AnnualCreditReport.com and monitor your financial accounts for unfamiliar activity. Since medical and health insurance information was also compromised, carefully review your Explanation of Benefits statements and any medical records for services you did not receive. If you suspect misuse of your information, visit IdentityTheft.gov for guidance on reporting and recovery.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
