UCHealth is mailing letters to roughly 129,000 people after discovering that an unauthorized third party broke into two employee accounts in its Microsoft cloud system over the summer, potentially exposing names, Social Security numbers, driver's license numbers, health information and billing details. The Aurora, Colorado-based health system says its electronic health record was never touched, but it is still urging affected individuals to watch their credit and financial accounts closely.
What Happened and When
According to a statement from UCHealth, the health system discovered on July 27, 2026 that the unauthorized party had gained access to the two employee accounts. UCHealth launched an internal investigation after making that discovery, and it says it moved to secure the affected accounts and environment from further unauthorized access. The organization also notified law enforcement about the incident, per the same statement.
The investigation found that the unauthorized activity was limited to certain services within the cloud system, and that the intruder may have acquired certain files stored there. Those files are described as including personal information relating to certain individuals — specifically names, Social Security numbers, driver's license numbers, health information and billing information, the notice states. UCHealth has repeatedly emphasized that its electronic health record system was not accessed during the incident.
No Evidence of Misuse, But Review Continues
UCHealth says its security team and outside experts monitored for any sign that the data had leaked further or been misused, and the organization reports it has not found any evidence that the information was inappropriately used or further disclosed. Still, the health system describes its review as ongoing in accordance with state and federal requirements, meaning the assessment could evolve as more information emerges.
About 129,000 individuals whose information may have been involved — and for whom UCHealth has a valid mailing address — are now receiving notification letters, per the health system's statement. For anyone whose Social Security or driver's license number was among the potentially affected data, UCHealth has arranged a complimentary one-year membership in Medical Shield Total. The organization is also taking additional steps to reduce the risk of similar incidents, including enhancing its technical security measures.
What Affected Individuals Should Do
UCHealth is directing anyone who receives a notice to review it carefully for specific protective steps, since the letter is the designated source for guidance tailored to each person's situation. More broadly, the health system is urging recipients to monitor their account statements and credit reports for signs of fraud or identity theft, and to notify their financial institution or account-maintaining company promptly if they spot suspicious activity.
Anyone who suspects fraud or identity theft is also advised to report it to law enforcement, including local police and their state attorney general. Individuals can review guidance from the Federal Trade Commission on fraud alerts, credit freezes and avoiding identity theft at identitytheft.gov, or by phone at 1-877-ID-THEFT (1-877-438-4338). UCHealth has also set up a confidential, toll-free inquiry line at 833.296.0859 for people with questions, available from 6 a.m. to 9 p.m. Mountain Time on weekdays and 7 a.m. to 4 p.m. on Saturdays.
A Pattern of Vendor and Cloud Incidents
This is not the first time UCHealth has had to notify people about data exposure tied to outside systems. In a separate incident involving the vendor Diligent, UCHealth said some of its patient, provider or employee data may have been included after Diligent's software was accessed and attachments — including UCHealth files — were downloaded, according to UCHealth Today. In that case, too, the health system said its systems, including its electronic medical record, were not impacted.
UCHealth was also notified on June 22 by Ambulnz by DocGo, a patient-transport vendor used at UCHealth facilities, that the vendor had suffered a cyberattack that may have affected patients, as reported by Becker's Hospital Review. UCHealth said its IT systems and electronic health records were not involved in that breach either, though the outlet noted UCHealth did not specify what kinds of patient information may have been involved in the Ambulnz incident.
Notification Requirements
UCHealth says its review is ongoing in accordance with state and federal requirements.
