Patient Notification

On May 30, 2023, it was brought to the attention of the UT Southwestern Privacy Office that on May 28, 2023, an unknown individual exploited a previously unidentified vulnerability within software, which allowed access to the files stored within UTSW’s MOVEit server. As a result of this attack, the UTSW Privacy Office confirmed the theft of certain protected health information. Based on the analysis of the stolen files, patient data varied and may have included name, date of birth, name of medication, dosage of medication, prescribing provider, and, for a smaller number, Social Security information. UT Southwestern is in the process of contacting each impacted patient through direct mail with specifics on the information that was stolen. We deeply regret the occurrence of this incident and any worry, distress, or difficulty that it may cause you. We want to reassure you that the protection of all UT Southwestern data is a top institutional priority. We have a dedicated team and call center available to assist in answering questions you may have. The center can be reached at 888-338-4222 or visit the response website. Please see the entire notification below, which includes additional precautions.

Our Commitment to You

At UT Southwestern, your safety and well-being are always our top priorities. You can count on us to deliver the care you need just as we always have – safely and effectively.

We continue to strongly encourage vaccination as the best defense against COVID-19. As an academic medical center, we are proud to share the latest advances in education, research, and clinical care. Our COVID-19 Updates and Vaccination websites offer tip sheets, educational resources, answers to frequently asked questions, and links to immediate scheduling for vaccination, both for adults and children ages 12-15. Vaccine information for children 5-11 is available through our partner Children’s Health.

Beginning Oct. 24, 2022, based on the low level of COVID-19 transmission in our community, masks are no longer required within most UT Southwestern clinical environments if you are symptom-free, but they remain a welcome precaution. Masks should continue to be worn by patients and guests visiting our Cancer Center clinics, Transplant clinics, Bone Marrow Transplant Unit, and Emergency Department.

Thank you for helping protect our community. We look forward to serving you.

Patient Notification

UT Southwestern Medical Center (UTSW) was one of the many organizations, both nationally and internationally, that experienced a cybersecurity attack affecting MOVEit software, which securely moves large data files between networks. On May 30, 2023, it was brought to the attention of the UTSW Privacy Office that on May 28, 2023, an unknown individual exploited a previously unidentified vulnerability within the software, which allowed access to the files stored within UTSW’s MOVEit server.

As a result of this attack, the UTSW Privacy Office confirmed the theft of certain protected health information. Based on the analysis of the stolen files, patient data varied and may have included name, date of birth, name of medication, dosage of medication, prescribing provider, and, for a smaller number, Social Security information.

UT Southwestern is in the process of contacting each impacted patient through direct mail with specifics on the information that was stolen. Once the attack was detected, UT Southwestern immediately took steps to secure systems and networks and limit the amount of information housed within its MOVEit server. A multidisciplinary team at UT Southwestern began identifying both individuals and types of data impacted to prepare notifications. We are now sending personalized notifications to individuals affected to explain the type of data involved. Monitoring for any additional suspicious activities is ongoing and continuous.

Receiving a notification does not mean that you are a victim of identity theft. At this time, UT Southwestern has not received any notification that your information has been used in a malicious manner. In the email you received, we have outlined precautionary actions you can take. Safety precautions you can take include changing passwords, using two-factor or multifactor authentication, and notifying credit bureaus and monitoring agencies of any suspicious activity. Resources include:  

• The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) joint CSA
• The Federal Trade Commission’s website on identity theft
• A free credit report, which is available online at annualcreditreport.com or by telephone at 877-322-8228. Call the telephone number listed on the credit report to report suspicious activity.  

These resources are being provided for informational purposes only. UT Southwestern does not endorse any product or service offered.

We deeply regret the occurrence of this incident and any worry, distress, or difficulty that it may cause you. We want to reassure you that the protection of all UT Southwestern data is a top institutional priority and that this incident is being handled in accordance with UTSW policies and related regulations.

We have a dedicated team and call center available to assist in answering questions you may have. The center can be reached at 888-338-4222 or visit the response website.