Massive data breach: 11 million HCA Healthcare patients affected

HCA Healthcare said on Monday that the personal information of about 11 million patients was stolen in a data breach. The incident was discovered on July 5, when a threat actor posted information allegedly stolen from HCA Healthcare on an underground forum. The threat actor's publication included a list of names, addresses, dates of birth, gender information, telephone numbers, email addresses, dates of service and dates of appointments.

Research still ongoing to confirm the impact

The investigation is still ongoing and we cannot confirm the number of individuals whose information has been affected. HCA Healthcare estimates that the list contains approximately 27 million rows of data that could include information for approximately 11 million HCA Healthcare patients. The information was pulled from "an external storage location used solely to automate the formatting of email messages".

Clinical and sensitive information was not stolen, says HCA

According to HCA Healthcare, no clinical information, payment information, or other sensitive information (such as passwords, social security numbers, and driver's license numbers) was stolen in the attack. However, DataBreaches.net says the hackers claim to be in possession of emails containing "health diagnoses that match a customer ID." Upon discovering the data breach, HCA Healthcare disabled user access to the compromised storage location and found no evidence of malicious activity on its network or systems.

No significant impact expected, says HCA

HCA Healthcare has reported the incident to law enforcement and plans to contact those affected, but believes the incident will not have a material impact. There have been no disruptions to the care and treatment services that HCA Healthcare provides to patients and communities, and the incident has not caused any disruption to HCA Healthcare's day-to-day operations. As one of the largest healthcare providers in the US, HCA Healthcare operates 180 hospitals and more than 2,300 outpatient care sites across 20 states and the UK.