Summary
- Environment: Four employee Microsoft 365 accounts
- Operational impact: Documents copied or downloaded; patient information potentially exposed
- Financial impact: No incident cost disclosed
- Record status: Developing record. Reviewed November 4, 2026; updated as evidence emerges.
What happened
El Camino Health identified unusual Microsoft 365 activity on September 1, 2026. Investigators found intermittent unauthorized access to four employee accounts from August 26 through September 2. [1]
Impact
Documents were copied or downloaded. Potential fields included contacts, identity numbers, birth dates, patient identifiers, diagnoses, treatment, prescriptions, provider and insurance information; some patients’ bank details could also be involved. [1]
Timeline
Reported unauthorized access begins
Reported unauthorized access begins, according to the published account. Incident notice.
[1]Unusual activity detected
Unusual activity detected, according to the published account. Incident notice.
[1]Reported access window ends
Reported access window ends, according to the published account. Incident notice.
[1]Briefing updated
This briefing was last reviewed and updated on November 4, 2026.
Threat Group & Attack Vector
The reviewed notice does not establish the initial access method.
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
El Camino secured the system, engaged forensic experts, notified law enforcement and added safeguards. Document review remained ongoing, and the notice offered a year of identity monitoring. [1]