HealthConsent
Active breach tracker New Orleans, LA Disclosed January 15, 2026

Tulane University Medical Group Data Breach 2026 (Cl0p Ransomware): 6,556 New Orleans Patients Exposed. What To Do

Tulane University Medical Group (TUMG), the faculty practice plan of Tulane University School of Medicine in New Orleans, was hit by the Cl0p ransomware group in November 2025. Names, dates of birth, diagnoses, treatment records, prescriptions, MRNs, health insurance, dates of service, and in a subset SSNs and driver's licenses for 6,556 patients exposed. Credit monitoring offered for SSN-affected subset. Here is what to do.

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated Sources & methodology

Timeline

Nov 10, 2025

Unauthorized party accesses TUMG email accounts via phishing

Nov 18, 2025

TUMG discovers PHI involvement; Cl0p posts Tulane on leak site same day

Jan 15, 2026

Filed with HHS OCR

Data exposed

01

High-risk identity

Enables financial + identity theft

Date of birth Driver's license number (subset) Social Security number, full or partial (subset)

02

Health records

Don't expire and can't be reissued

Diagnosis / treatment records Prescription information Medical record numbers

03

Contact & insurance

Phishing + targeted scams

Full name Contact information Health insurance numbers Dates of service

Class actions filed by

These firms have publicly announced investigations. You may be eligible to join. We are not a law firm and cannot give legal advice.

Federman & Sherwood (publicly investigating) Migliaccio & Rathod (publicly investigating) Almeida Law Group (publicly investigating)
If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

01

Accept credit monitoring

It’s the floor of the response. Take it.

02

Freeze your credit

Free at Equifax, Experian, TransUnion.

03

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

04

Review your EOBs

Insurance statements catch medical identity theft early.

05

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

What happened

Tulane University Medical Group (TUMG) is the faculty practice plan for physicians of Tulane University School of Medicine in New Orleans, Louisiana. TUMG is the multispecialty clinical arm — distinct from the Tulane hospitals (which were sold to LCMC Health). TUMG operates under the corporate name “Administrators of the Tulane Educational Fund.”

On November 10, 2025, an unauthorized party accessed TUMG email accounts via phishing. On November 18, 2025, TUMG discovered that PHI may have been involved. The same day, the Cl0p ransomware group posted Tulane to its dark-web leak site. TUMG filed with HHS OCR on January 15, 2026 confirming 6,556 affected individuals.

Cl0p has been one of the most prolific data-theft extortion groups of 2025-2026, known for exploiting file-transfer software vulnerabilities (MOVEit, GoAnywhere, Cleo) at scale. TUMG’s email-phishing intrusion may have been the foothold for broader access.

The breach impacted clinical email accounts, not Tulane’s broader university or hospital EMR systems per public statements.

What was stolen

Per TUMG’s notice:

  • Full name, date of birth, contact information
  • Diagnosis and treatment records
  • Prescription information
  • Medical record numbers
  • Health insurance numbers
  • Dates of service

For a limited subset of affected patients:

  • Driver’s license number
  • Social Security number (full or partial)

What TUMG is offering

  • Forensic investigation, access revoked, comprehensive file review
  • Additional security safeguards and workforce security awareness training
  • Free credit monitoring to individuals whose SSN was involved (subset only — not all affected)
  • Call center: 855-815-3936 (Monday to Friday, 8 a.m. to 8 p.m. Central)

What to do

  1. Read your specific notification letter carefully. If your SSN was involved, enroll in the offered credit monitoring.
  2. Place free credit freezes at all three bureaus — recommended even if your SSN was not in scope, because Cl0p leak-site postings are routinely scraped and recirculated.
  3. File IRS Form 14039 if your SSN was involved.
  4. Watch your insurance Explanation of Benefits statements for unfamiliar specialty claims.
  5. Stop the ongoing flow of your academic-medical-center data. HealthConsent files HIPAA restriction requests so the diagnostic and prescription data exposed in this breach is not continuously re-shared.

Continue reading

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.