Aurora, Colo. (November 13, 2026) – UCHealth, including its affiliated healthcare facilities (collectively “UCHealth”), is notifying individuals of a recent data security incident in which accounts were inappropriately accessed.
On July 27, 2026, UCHealth discovered that an unauthorized third party gained access to two employee accounts in UCHealth’s Microsoft cloud system. As soon as this was discovered, UCHealth launched an internal investigation, secured the affected accounts and environment from further unauthorized access, and notified law enforcement of the incident. UCHealth’s investigation determined that the unauthorized activity was limited to certain services within the cloud system and that the unauthorized third party may have acquired certain files stored there. Importantly, UCHealth’s electronic health record was not accessed.
UCHealth’s investigation of the accessed files found that some contain personal information related to certain individuals. Depending on the individual, the information may include their name and their Social Security number, driver’s license number, health information, and billing information. UCHealth’s security team and outside experts have monitored for any subsequent leak or use of this data and have not found any evidence that it was inappropriately used or further disclosed. UCHealth is mailing notification letters to about 129,000 individuals whose information is determined to have been potentially involved and for whom it has a valid address. UCHealth’s review remains ongoing in accordance with state and federal requirements.
Involved individuals should refer to the notice they receive in the mail for steps they can take to protect themselves. UCHealth has arranged for individuals whose Social Security numbers or driver’s license numbers were involved in the incident to enroll in a complimentary one-year membership in Medical Shield Total. As a precautionary measure, individuals should remain vigilant about potential fraud and/or identity theft by reviewing account statements and monitoring credit reports closely. If individuals detect suspicious activity on an account, they should promptly notify the financial institution or company that maintains the account. They should also report fraudulent activity or suspected identity theft to law enforcement, including the police and their state attorney general.
Individuals may wish to review the Federal Trade Commission (“FTC”) guidance on fraud alerts, security/credit freezes, and avoiding identity theft. For more information, visit IdentityTheft.gov or call 1-877-ID-THEFT (1-877-438-4338). Individuals may also contact the FTC at: Federal Trade Commission, 600 Pennsylvania Avenue, NW, Washington, DC 20580.
Individuals can also contact the national credit reporting agencies at:
| Equifax 1-800-349-9960 www.equifax.com P.O. Box 105788 Atlanta, GA 30348 | Experian 1-888-397-3742 www.experian.com P.O. Box 9554 Allen, TX 75013 | TransUnion 1-800-888-4213 www.transunion.com P.O. Box 1000 Chester, PA 19016 |
UCHealth is committed to maintaining the privacy and security of the information entrusted to it. UCHealth is taking additional steps to reduce the risk of this type of incident occurring in the future, including enhancing its technical security measures. Individuals seeking additional information may call a confidential, toll-free inquiry line at 833.296.0859 from 6 a.m. to 9 p.m. Mountain Time, Mondays through Fridays, and from 7 a.m. to 4 p.m. on Saturdays.
