University Hospitals Working on Restoring Systems After Cyberattack
University Hospitals is working on restoring systems after an October 22 cyberattack. Cybersecurity incidents have also been announced by EyeMed Vision Care and Facial Surgery Group.
University Hospitals
Cleveland, Ohio-based University Hospitals, a 21-hospital health system, is dealing with a cybersecurity incident that was identified on October 22, 2026. University Hospitals activated its incident response protocols and implemented containment measures, which included taking digital services offline, including its MyChart patient portal, while the incident is investigated and mitigated. University Hospitals is still working on safely restoring the affected systems, and in a November 2, 2026, update, confirmed that systems remained offline. A timeline for the restoration of normal business operations cannot be provided.
The health system confirmed that its hospitals, emergency departments, and physician offices remain open, but the incident has disrupted pre-authorizations, and some appointments and elective procedures have had to be rescheduled. The nature of the cyberattack, such as if ransomware was involved, has not been publicly disclosed. No ransomware group appears to have claimed responsibility for the incident. The investigation is ongoing, and University Hospitals has not yet determined the extent to which patient data was involved.
Avail of a Free 30-Minute
Cybersecurity Consultation
with Blue Team Alpha
Review your security program, get advice on a specific cybersecurity concern, identify risk-reduction priorities, or take the first step toward your annual HIPAA Security Risk Assessment.
Learn More About This Offer
EyeMed Vision Care
EyeMed Vision Care, a Cincinnati, Ohio-based vision insurance provider, has started notifying certain individuals about an email error that resulted in an impermissible disclosure of members’ sensitive information. On September 22, 2026, EyeMed Vision Care sent an email containing member information to an incorrect email address. The incident was the result of human error, was not malicious in nature, and involved a single misdirected email. The email contained information about individuals enrolled in a vision benefit plan managed by EyeMed Vision Care, including names, addresses, dates of birth, Social Security numbers, and membership identification numbers.
The number of affected individuals has not yet been publicly disclosed; however, since the California Attorney General was notified about the data breach, at least 500 California residents have been affected. EyeMed said it has taken steps to prevent similar incidents in the future, including revising its privacy and operations policies and procedures, updating its training program, and retraining appropriate members of its workforce. As a precaution against data misuse, the affected individuals have been offered complimentary credit monitoring and identity theft protection services.
Facial Surgery Group
Facial Surgery Group, the operator of five oral and maxillofacial surgery centers in Kansas City, Liberty, Overland Park, and Blue Springs, Missouri, has confirmed that the personal and protected health information of 11,407 individuals has been exposed in an email security incident. On September 16, 2026, a notice was added to the Facial Surgery Group website providing further information on the incident. Suspicious activity was identified within its email system on November 24, 2025. Third-party cybersecurity experts were engaged to investigate the incident and confirmed that a single email account had been accessed by an unauthorized individual.
A data mining company was engaged to review the affected account, and that process was completed on September 9, 2026. The account contained names, birth dates, demographic information, Social Security numbers, financial account numbers, and health information. The affected individuals were notified about the incident on October 9, 2025. Steps have been taken to prevent similar incidents in the future, and the affected individuals have been offered complimentary credit monitoring and identity theft restoration services.
