HCA Healthcare

Disclosed Jul 10, 202311,270,000 affectedConfirmed

Patient contact data from HCA email system posted on hacking forum

HCA Healthcare disclosed that a list of patient information used for appointment reminder emails, including names, contact details, dates of birth and service dates and locations, was posted on an online forum. It said no clinical, payment, password or Social Security data was included.

What is known

People affected	11,270,000 (as reported by the organization)
Disclosed	Jul 10, 2023
Discovered	Jul 5, 2023
Happened	Jun 29, 2023
Attack	Hacking
Data exposed	NamesEmailsPhone numbersAddressesDates of birthHealth
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: HCA Healthcare

Official noticeatg.wa.gov

Washington Attorney General breach notice: HCA Healthcare

Official noticeattorneygeneral.delaware.gov

Notice letter filed with the Delaware DOJ: HCA Healthcare

Official noticejustice.oregon.gov

Oregon DOJ breach notice: HCA Healthcare

SEC filingsec.gov

HCA Healthcare reports data security incident (8-K Exhibit 99.1, July 10, 2023)

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): HCA Healthcare (Business Associate, TN)

Notices filed

TotalJul 10, 2023

Research11,270,000 people

Residents of DEJul 14, 2023

Delaware DOJ1,727 people

TotalJul 31, 2023

HHS archive11,270,000 people

Residents of CAAug 1, 2023

California AGCount not stated

Residents of WAAug 1, 2023

Washington AG7,500 people

Residents of ORAug 30, 2023

Oregon DOJCount not stated

Other breaches at HCA Healthcare

Breach, details not statedExposed Social Security numbers, health records and insurance details. Reported to the California AG.29K affectedHealthcareUSOct 29

History of this record

source2026-09-25

empty to https://ocrportal.hhs.gov/ocr/breach/breach_report.jsfby backfillSource

attack2026-09-25

lost-device to hackingby seedSource

data_types2026-09-25

["names"] to ["names","emails","phone","addresses","dob","health"]by seedSource

records_basis2026-09-25

empty to organizationby seedSource

records2026-09-25

empty to 11270000by seedSource

disclosed2026-09-25

2023-07-14 to 2023-07-10by seedSource

summary2026-09-25

empty to HCA Healthcare disclosed that a list of patient information used for appointment reminder emails, including names, contact details, dates of birth and service dates and locations, was posted on an online forum. It said no clinical, payment,by seedSource

title2026-09-25

empty to Patient contact data from HCA email system posted on hacking forumby seedSource

data_types2026-09-25

[] to ["names"]by backfillSource

disclosed2026-09-25

2023-08-01 to 2023-07-14by backfillSource

attack2026-09-25

unknown to lost-deviceby backfillSource

discovered2026-09-25

empty to 2023-07-05by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about HCA Healthcare