An Alabama medical center says the protected health information of more than 19,000 patients has been exposed through a computer hacking attack.

It’s unclear exactly how many of the records might have been improperly viewed. But news outlets report that a statement issued Friday says UAB Medicine is notifying 19,557 patents that their personal information could be vulnerable.

A news release says hackers got into the records through a malicious email that looked like a request from an executive who wanted employees to fill out a survey.

Instead, the email actually allowed hackers to get into workers’ email accounts and the payroll system. Cybercriminals attempted to divert workers automatic payroll deposits into an account controlled by hackers.

UAB Medicine says it discovered the attack in early August.