Mayo Clinic mayoclinic.org Mayo Clinic data breach: what happened and what to do
Mayo Clinic learned on February 28, 2025 that a researcher sent limited data from a liver study to a personal email account. It affected 1,869 patients. It included medical record numbers, diagnoses and dates of service, but no names or Social Security numbers.
View all 13,115 breaches- Breach date
- 28 Feb 2025
- Made public
- 28 Mar 2025
- Affected
- 1,869
- Data exposed
- Medical record numbers, Medical information
- Last updated
What happened
On February 28, 2025, Mayo Clinic learned that a researcher had sent limited patient information from a liver study to a personal email account, against Mayo policy. The researcher shared it with six other people who are not affiliated with Mayo. The incident involved 1,869 patients.
What was exposed
Mayo says the data included Mayo medical record numbers, information about diagnoses and dates of service. Names, addresses and other directly identifying details were not included. Social Security numbers, dates of birth and financial information weren't involved either.
What it means for you
This is a smaller and lower-risk incident than most on this site. Without a name or address, the data is hard to tie to you, and Mayo isn't recommending that affected patients take any action. The realistic risk is a scam that uses what it knows about your care, so be wary of unexpected calls about a diagnosis or treatment.
The company's response
Mayo tried to write to affected patients, but a number of letters came back undeliverable, so it published a substitute notice on its website. It also worked with the researcher to have the data permanently deleted.
What to do if you were in it
- 1
Read Mayo's notice
Mayo's substitute notice explains exactly what was sent. If you took part in the liver study, it applies to you.
- 2
Be wary of calls about your health
If someone contacts you about a diagnosis or treatment you didn't ask about, hang up and call Mayo Clinic on a number from its website.
- 3
Keep your address current with Mayo
Some notice letters were returned as undeliverable. Updating your contact details means you'll get future notices.
- 4
Check whether your email or phone is in this and other breaches
A free Serus scan shows where your email address and phone number have appeared in known breaches and tells you what to do next.
Frequently asked
Was I affected?
Mayo notified 1,869 patients whose data came from a liver study. If you didn't take part in that study, this incident didn't involve your data.
What was exposed?
Medical record numbers, diagnoses and dates of service. Names, addresses, dates of birth, Social Security numbers and financial information weren't included.
Do I need to do anything?
Mayo isn't recommending that affected patients take any action. Staying alert to unexpected calls about your health is still sensible.
Should I change my password?
No passwords were involved in this incident.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
