HCA Healthcare
Disclosed Jul 10, 20233 years ago11,270,000 affectedConfirmed
Patient contact data from HCA email system posted on hacking forum
HCA Healthcare disclosed that a list of patient information used for appointment reminder emails, including names, contact details, dates of birth and service dates and locations, was posted on an online forum. It said no clinical, payment, password or Social Security data was included.
What is known
| People affected | 11,270,000 (as reported by the organization) |
|---|---|
| Disclosed | Jul 10, 2023 |
| Discovered | Jul 5, 2023 |
| Happened | Jun 29, 2023 |
| Attack | Hacking |
| Data exposed | Names, Emails, Phone numbers, Addresses, Dates of birth, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: HCA Healthcareoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: HCA Healthcareatg.wa.gov · Official notice | Official notice |
| Notice letter filed with the Delaware DOJ: HCA Healthcareattorneygeneral.delaware.gov · Official notice | Official notice |
| Oregon DOJ breach notice: HCA Healthcarejustice.oregon.gov · Official notice | Official notice |
| HCA Healthcare reports data security incident (8-K Exhibit 99.1, July 10, 2023)sec.gov · SEC filing | SEC filing |
| HHS OCR breach report (archive, resolved): HCA Healthcare (Business Associate, TN)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Jul 10, 2023 | 11,270,000 |
| Delaware DOJresidents of DE | Jul 14, 2023 | 1,727 |
| HHS archivetotal | Jul 31, 2023 | 11,270,000 |
| California AGresidents of CA | Aug 1, 2023 | |
| Washington AGresidents of WA | Aug 1, 2023 | 7,500 |
| Oregon DOJresidents of OR | Aug 30, 2023 |
History of this record
- 2026-09-25 · source: empty to https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf · backfill source
- 2026-09-25 · attack: lost-device to hacking · seed source
- 2026-09-25 · data_types: ["names"] to ["names","emails","phone","addresses","dob","health"] · seed source
- 2026-09-25 · records_basis: empty to organization · seed source
- 2026-09-25 · records: empty to 11270000 · seed source
- 2026-09-25 · disclosed: 2023-07-14 to 2023-07-10 · seed source
- 2026-09-25 · summary: empty to HCA Healthcare disclosed that a list of patient information used for appointment reminder emails, including names, contact details, dates of birth and service dates and locations, was posted on an online forum. It said no clinical, payment, · seed source
- 2026-09-25 · title: empty to Patient contact data from HCA email system posted on hacking forum · seed source
- 2026-09-25 · data_types: [] to ["names"] · backfill source
- 2026-09-25 · disclosed: 2023-08-01 to 2023-07-14 · backfill source
- 2026-09-25 · attack: unknown to lost-device · backfill source
- 2026-09-25 · discovered: empty to 2023-07-05 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.