◆ A data breach at University of New Mexico (UNM) Health may have allowed a third party to obtain medical records from more than 600,000 patients—more than a quarter of the state’s population. UNM Health has been mailing letters to affected patients who had been treated at UNM Hospital, UNM Medical Group or the UNM Sandoval Regional Medical Center, hospital officials said. The breach occurred on May 2 and was discovered on June 4, according to UNM Health’s statement. Patient names, medical record numbers and Social Security numbers were among the information obtained during the data breach, said Michael Richards, senior vice chancellor for clinical affairs at UNM Health System. Richards added that electronic medical records were not involved, and that there was no indication that any information has been misused. UNM Health will provide complimentary credit monitoring and data protection services to patients who had their Social Security numbers taken.^[1]

◆ Indianapolis-based Eskenazi Health said a cyberattack that occurred “on or about August 4, 2021,” resulted in the compromise of personal information belonging to employees and patients, including health information. Some of the information was posted on the dark web, the health system said. Eskenazi Health’s information security team took the network offline when the breach was detected. Cybercriminals gained access to the network May 19 and disabled security protections, which made it more difficult to detect their presence prior to the attack, the health system said. Investigators determined that stolen medical, financial and demographic information was posted, including names, dates of birth, ages, addresses, telephone numbers, email addresses, medical record numbers, patient account numbers, diagnoses, clinical information, physician names, insurance information, prescriptions, dates of service, driver’s license numbers, passport numbers, face photos, Social Security numbers and credit card information. Eskenazi Health will provide identity theft protection for affected individuals.^[2]