Short answer
University Hospitals detected unusual activity on its servers on 22 October 2026 and disconnected its systems from the internet. As of its 2 November update, MyChart and some digital services were still offline with no restoration date. Hospitals and emergency departments remain open.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | University Hospitals (Cleveland, Ohio) |
|---|---|
| Incident type | Data breach |
| Status | Under investigation |
| Sector | Healthcare (hospital system) |
| Country | United States |
| Detected | 2026-10-22 |
| Disclosed | 2026-10-23 |
| People or records affected | Not disclosed. UH has not said whether patient data was accessed. |
What data was exposed
- Not confirmed. UH's notice does not say whether patient data was accessed or taken.
What happened
University Hospitals (UH) is a large health system based in Cleveland, Ohio. On its cybersecurity incident page, UH says it detected unusual activity on its servers on 22 October 2026 and disconnected its systems from the internet as a precaution. Cleveland 19 reported digital service disruptions on 23 October and that, as of 28 October, patients still could not use MyChart.
In its update dated 2 November, UH said it was restoring systems safely and had no estimated timeline. HIPAA Journal noted on 4 November that no ransomware group had claimed responsibility.
What is affected
According to UH:
- MyChart and some digital services are offline;
- lab results cannot be viewed in MyChart, though Quest results are on Quest’s website;
- video visits have moved to phone, Zoom or in-person visits;
- UH is cashless, so payments go through its automated line or website;
- phones work, but hold times are long;
- outpatient pharmacies are open, with prescriptions printed, faxed or phoned in when e-prescribing is down.
Hospitals, emergency departments and physician offices remain open.
What is not known
UH’s notice does not say whether patient data was accessed or taken, how the attackers got in, or when systems will return. We have not seen a confirmed attacker claim or any leaked data.
Staying safe
Outages like this are used by scammers. UH specifically warns that it will not call or text asking for banking information. A message about a locked MyChart account, an unpaid bill or a “refund” during the outage should be checked by calling UH on a published number. Our guide to phishing messages explains how to spot a fake sender, and what to do after a data breach applies if UH later confirms patient data was taken. For fake billing demands, see government impersonation scams for the same pressure tactics.
More recent incidents are on the breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake texts or calls claiming to be UH about 'MyChart access', billing or account verification
- Callers asking for banking details to 'fix' a payment while UH is cashless (UH says it will not call or text for banking information)
- Phishing emails promising lab results or a restored MyChart login through a link
- Opportunistic breach 'compensation' or lawsuit messages that ask for personal details
What to do if you are affected
- 01Use only the phone numbers and web address on UH's official cybersecurity incident page. UH lists 1-866-UH4-CARE for appointments.
- 02Do not respond to calls, texts or emails asking for banking information. UH says it will not ask for it that way.
- 03Pay bills through UH's automated line or official website, not through a link in a message.
- 04Ask your doctor's office how to get lab results while MyChart is down. UH says Quest results are on Quest's site.
- 05Watch for a notice from UH. If patient data turns out to be involved, notification would come from UH directly.
Frequently asked questions
Is University Hospitals open?
Yes. UH says its hospitals, emergency departments and physician offices remain open and the vast majority of appointments and procedures have continued as normal.
Was patient data stolen?
UH has not said. Its notice does not state whether patient data was accessed or taken, and the investigation is continuing.
Was it ransomware?
UH has not said what kind of attack it was. HIPAA Journal reports that no ransomware group has claimed it. The incident type on this page is a placeholder category, since neither a breach nor ransomware has been confirmed.
What is not working?
MyChart and some digital services are offline, lab results are not viewable in MyChart, video visits moved to phone, Zoom or in person, and UH is cashless. Phone hold times are long.
Is there a lawsuit?
Class action sites report a complaint filed in federal court in Ohio on 28 October. A lawsuit is an allegation, not a finding.
Sources
- Cybersecurity Incident, University Hospitals, 2026-11-02
- University Hospitals working to restore MyChart; appointments continue as normal, Cleveland 19 (WOIO), 2026-10-28
- University Hospitals Working on Restoring Systems After Cyberattack, HIPAA Journal, 2026-11-04
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.