1. News
  2. Security & privacy
  3. Health · Cyberattack
Health · Cyberattack2 min read

Ohio hospital system still has systems offline after cyberattack

University Hospitals in Ohio still had systems offline on November 2 after a cyberattack. Two other recent incidents exposed Social Security numbers.

By the Dashline deskSource: HIPAA Journal
Ohio hospital system still has systems offline after cyberattack
Photo: Ajay Suresh, CC BY 4.0

University Hospitals, a 21-hospital health system based in Cleveland, Ohio, still had its systems offline on November 2, 2026. The health system found a cyberattack on October 22. Its hospitals, emergency departments and physician offices are open, but some care has been disrupted.

What happened

After finding the problem, University Hospitals started its incident response plan and took digital services offline to contain it. That includes its MyChart patient portal. The health system says it is working to restore the affected systems safely. It has said it cannot give a timeline for getting back to normal operations.

What patients may notice

  • Pre-authorizations, the insurance approvals some care needs, have been disrupted.
  • Some appointments and elective procedures have been rescheduled.
  • The MyChart patient portal was taken offline while the incident is handled.

Several basics are still unknown. The health system has not said what kind of attack it was, including whether ransomware was involved. No ransomware group appears to have claimed it. The investigation is ongoing, and University Hospitals has not yet determined how much patient data was involved.

Other incidents with Social Security numbers

EyeMed Vision Care, a vision insurance provider in Cincinnati, Ohio, sent one email to the wrong address on September 22, 2026. The company says it was human error and not malicious. The email held names, addresses, birth dates, Social Security numbers and membership ID numbers. At least 500 California residents were affected. The full number is not public.

Facial Surgery Group, which runs five oral and maxillofacial surgery centers in Missouri, said 11,407 people had information exposed. One email account was accessed by an unauthorized person. It held names, birth dates, Social Security numbers, financial account numbers and health information. Both organizations offered free credit monitoring and identity theft services.

What to do

If you use University Hospitals, expect possible delays and check with your provider before an appointment or procedure. For any health provider or insurer, read your statements closely. If you receive a breach notice, consider accepting the free credit monitoring on offer.

The takeaway

If a health provider or insurer you use reports a breach, check your statements closely and take any free credit monitoring offered.

More articles

You should really read these.

Next step

Let’s talk