Notice of Data Security Incident
Posted Date: September 15, 2026
The Administrators of the Tulane Educational Fund d/b/a Tulane University Medical Group (“TUMG”) is committed to protecting the privacy and security of the information we maintain. We are providing this notice regarding a recent incident that may have involved certain individuals’ protected health information, along with the measures TUMG took in response, and some steps that the individuals can take in response.
What Happened?
On July 13, 2026, an unauthorized party gained access to a TUMG physician’s cloud-based storage account through a phishing cyberattack. On July 17, 2026, TUMG determined that the affected account may have contained individuals’ protected health information.
What Information Was Involved?
The information involved varies by individual and may have included one or more of the following about impacted patients:
- patient names
- parent names
- addresses
- phone numbers
- dates of birth
- medical treatment information
No Social Security numbers or financial information were involved.
What TUMG Is Doing:
TUMG promptly investigated the incident and took steps to mitigate potential harm, including immediately removing the unauthorized party’s access to the account and conducting a forensic analysis . Additionally, TUMG implemented additional security safeguards and is conducting additional security awareness training for TUMG workforce members.
How Will I Know If I Am Affected?
On September 15, 2026, we began mailing notification letters via United States Postal Service First-Class mail to individuals whose information was involved in the incident. This public notice is being provided as a substitute for some individual notices because TUMG was unable to obtain sufficient contact information for certain potentially affected individuals.
Individuals who have questions or would like additional information regarding this incident may contact the dedicated toll-free assistance line:
- (888) 256-9179 (This toll-free number will be available for at least 90 days).
