HCA Healthcare confirms breach with patient and employee data
HCA Healthcare, operator of 189 hospitals in 19 U.S. states, confirmed unauthorized access to certain IT systems on August 12, 2026. The threat actor copied HR files on medical residents and patient data from affiliated facilities and physician offices, including names, Social Security numbers, and medical information. The total number of affected people has not been disclosed, though 15,096 Texas residents are known to have been affected; HCA is offering two years of free credit monitoring.
What happened
HCA Healthcare, operator of 189 hospitals in 19 U.S. states, identified suspicious activity in certain IT systems on August 12, 2026, and forensic investigation confirmed unauthorized access. The threat actor copied HR files on medical residents and patient data from affiliated facilities and physician offices.
Why it matters
The copied data includes names, dates of birth, email addresses, phone numbers, Social Security numbers, immigration information, medical and health insurance information, creating identity theft and fraud risk. The total number of affected people has not been disclosed, though 15,096 Texas residents are known to have been affected. The company operates about 2,600 ambulatory sites.
What to do
HCA is offering affected individuals two years of free credit monitoring; they should enroll and review statements and medical bills. The company should review access controls on IT systems and HR files.
For the technical team
- Affected
- HCA Healthcare, operadora de 189 hospitais e cerca de 2.600 sites ambulatoriais em 19 estados dos EUA; sistemas de TI co · HR files on medical residents with employment data: name, date of birth, email address, phone number, Social Security number, and immigration information. Patient data from certain affiliated facilities and physician offices: names, email addresses, phone numbers, dates of birth, Social Security numbers, medical and health insurance information.
- Exploitation
- Unauthorized access and file copying confirmed by forensic investigation, according to HCA Healthcare itself.
- Fix
- No software fix. HCA is offering affected individuals two years of free credit monitoring.
- Vector
- Unauthorized access to certain HCA Healthcare IT systems, detected through suspicious activity and confirmed by forensic investigation. The initial entry vector has not been disclosed.
- More details
- Suspicious activity identified and unauthorized access confirmed on August 12, 2026. The total number of affected patients has not yet been disclosed; 15,096 Texas residents are known to have been affected.
Timeline
HCA Healthcare disclosed a cybersecurity incident involving copied HR files of medical residents.
