Connect with us

Hi, what are you looking for?


Data Breaches

Personal Information of 11 Million Patients Stolen in Data Breach at HCA Healthcare

HCA Healthcare says the personal information of roughly 11 million patients was stolen in a data breach.

HCA Healthcare on Monday announced that the personal information of roughly 11 million patients was stolen in a data breach.

The incident, the healthcare services provider says, was discovered on July 5, after a threat actor posted on an underground forum information allegedly stolen from HCA Healthcare.

The threat actor posted a list containing names, addresses, birth dates, gender information, phone numbers, email addresses, service dates, and appointment dates, HCA Healthcare says in an incident notice.

“The investigation is ongoing and we cannot confirm the number of individuals whose information was impacted. HCA Healthcare believes that the list contains approximately 27 million rows of data that may include information for approximately 11 million HCA Healthcare patients,” the company says.

The information was extracted from “an external storage location exclusively used to automate the formatting of email messages”.

According to the healthcare services provider, clinical information, payment information, or other sensitive information (such as passwords, Social Security numbers, and driver’s license numbers) was not stolen in the attack.

According to, however, the hackers claim to be in the possession of emails containing “health diagnosis that correspond to a client ID”.

Advertisement. Scroll to continue reading.

HCA Healthcare also says that it disabled user access to the compromised storage location immediately after discovering the data breach and that it has found no evidence of malicious activity on its network or systems.

“There has been no disruption to the care and services HCA Healthcare provides to patients and communities. This incident has not caused any disruption to the day-to-day operations of HCA Healthcare,” the company says.

HCA Healthcare has informed law enforcement of the incident and plans to contact the impacted individuals, but believes that the incident will not have a material impact.

One of the largest healthcare services providers in the US, HCA Healthcare operates 180 hospitals and more than 2,300 ambulatory sites of care across 20 states and the United Kingdom.

Related: 28,000 Impacted by Data Breach at Pepsi Bottling Ventures

Related: American Airlines, Southwest Airlines Impacted by Data Breach at Third-Party Provider

Related: Intellihartx Informs 490k Patients of GoAnywhere-Related Data Breach

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join security experts as they discuss ZTNA’s untapped potential to both reduce cyber risk and empower the business.


Join Microsoft and Finite State for a webinar that will introduce a new strategy for securing the software supply chain.


Expert Insights

Related Content

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Data Breaches

LastPass DevOp engineer's home computer hacked and implanted with keylogging malware as part of a sustained cyberattack that exfiltrated corporate data from the cloud...

Data Breaches

A group of hackers has leaked Atlassian employee records and floorplans, information that was obtained from third-party workplace platform Envoy.

Data Breaches

GoTo said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach.

Data Breaches

AT&T is notifying millions of wireless customers that their CPNI was compromised in a data breach at a third-party vendor.

Data Breaches

KFC and Taco Bell parent company Yum Brands says personal information was compromised in a January 2023 ransomware attack.


Instant Checkmate and TruthFinder have disclosed data breaches affecting a total of more than 20 million users.