Almeida Law Group is investigating a data breach at Vanderbilt University Medical Center. If you were affected, contact Almeida Law Group.
About Vanderbilt University Medical Center
Vanderbilt University Medical Center (VUMC) is a large nonprofit academic health system headquartered in Nashville, Tennessee, operating under the clinical brand name Vanderbilt Health. It is one of the largest academic medical centers in the Southeast, providing patient care, biomedical research, and health professional training. VUMC operates multiple hospitals and healthcare facilities across Middle Tennessee, handles more than 2.3 million patient visits annually, and serves as the only Level I trauma center in the region. Because VUMC provides direct patient care, it holds detailed health and medical information about the individuals it serves.
What Happened?
Vanderbilt University Medical Center was listed in an HHS Office for Civil Rights breach portal report filed on July 24th, 2026, identifying a hacking/IT incident affecting 3,298 individuals. The breached information was located in email.
According to Vanderbilt Health’s disclosure, an employee clicked a malicious link in a message on March 23rd, 2026, which gave an unauthorized individual access to the employee’s email account. The compromise was discovered on March 27th, 2026. A subsequent investigation found evidence that the unauthorized person accessed certain documents and may have viewed email attachments containing patient information. Vanderbilt Health confirmed that its electronic medical record system was not affected and that no Social Security numbers or financial account information were involved. The exposed information included patient names, medical record numbers, admission, discharge, and visit dates, diagnosis or procedure information, and provider or facility names. Patient notification occurred on July 24th, 2026, approximately four months after the breach.
VUMC has experienced prior cybersecurity incidents. In late November 2023, the Meow ransomware gang claimed to have exfiltrated database contents from VUMC, and VUMC confirmed a cybersecurity incident involving a compromised database. Separately, VUMC faced an OCR investigation and a class action lawsuit in 2023 after non-anonymized transgender patient medical records were disclosed to the Tennessee Attorney General without patient consent. These are distinct from the 2026 email breach. As of early August 2026, at least one law firm, Shamis & Gentile P.A., is investigating the 2026 incident for potential class action claims, though no lawsuit has been filed.
Key Facts at a Glance
- Company or Organization: Vanderbilt University Medical Center
- Industry: Healthcare Provider — Academic Medical Center
- Location: Nashville, Tennessee
- Incident type: Hacking/IT Incident (phishing — employee email account compromise)
- Date of breach: March 23rd, 2026
- Date breach discovered: March 27th, 2026
- Date of consumer notification: July 24th, 2026
- Total persons affected: 3,298
- Prior breach: Yes — 2023 Meow ransomware database compromise (confirmed by VUMC); 2023 OCR investigation and class action over unauthorized disclosure of transgender patient records
- Litigation status: At least one law firm investigating for potential class action; no lawsuit filed as of early August 2026
- Source: HHS Office for Civil Rights Breach Portal; WKRN; Yahoo News; Hoodline
What Should You Do?
If you received a notice from Vanderbilt Health about this breach, review it carefully for any identity protection enrollment offer and note any enrollment deadline. Because health information was involved, review your Explanation of Benefits statements and request a copy of your medical records to check for any unfamiliar treatments or charges. Place a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — and monitor your accounts and credit reports regularly. You can obtain a free credit report at AnnualCreditReport.com. If you suspect identity theft or fraud, visit IdentityTheft.gov for step-by-step guidance on what to do next.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
