---
title: "El Camino Health Microsoft 365 incident"
description: "El Camino Health identified unusual Microsoft 365 activity on September 1, 2026. Investigators found intermittent unauthorized access to four employee accounts from August 26 through September 2."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-04"
canonical_url: "https://www.ally.security/incidents/el-camino-health-microsoft-365-incident-2026"
markdown_url: "https://www.ally.security/incidents/el-camino-health-microsoft-365-incident-2026.md"
stix_url: "https://www.ally.security/incidents/el-camino-health-microsoft-365-incident-2026/stix.json"
---

# El Camino Health Microsoft 365 incident

El Camino Health identified unusual Microsoft 365 activity on September 1, 2026. Investigators found intermittent unauthorized access to four employee accounts from August 26 through September 2.

Last modified Nov 4, 2026 · 1 source

## Summary

- **Environment:** Four employee Microsoft 365 accounts
- **Operational impact:** Documents copied or downloaded; patient information potentially exposed
- **Financial impact:** No incident cost disclosed

## What happened

[El Camino Health](https://www.elcaminohealth.org/) identified unusual [Microsoft 365](https://www.microsoft.com/microsoft-365) activity on September 1, 2026. Investigators found intermittent unauthorized access to four employee accounts from August 26 through September 2. [1](#source-1)

## Impact

Documents were copied or downloaded. Potential fields included contacts, identity numbers, birth dates, patient identifiers, diagnoses, treatment, prescriptions, provider and insurance information; some patients’ bank details could also be involved. [1](#source-1)

## Timeline

### August 26, 2026 — Reported unauthorized access begins

Reported unauthorized access begins, according to the published account. [Incident notice](https://oag.ca.gov/system/files/El%20Camino%20-%20California%20Notification.pdf). [1](#source-1)

### September 1, 2026 — Unusual activity detected

Unusual activity detected, according to the published account. [Incident notice](https://oag.ca.gov/system/files/El%20Camino%20-%20California%20Notification.pdf). [1](#source-1)

### September 2, 2026 — Reported access window ends

Reported access window ends, according to the published account. [Incident notice](https://oag.ca.gov/system/files/El%20Camino%20-%20California%20Notification.pdf). [1](#source-1)

### November 4, 2026 — Briefing updated

This briefing was last reviewed and updated on November 4, 2026.

## Threat Group & Attack Vector

The reviewed notice does not establish the initial access method.

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

El Camino secured the system, engaged forensic experts, notified law enforcement and added safeguards. Document review remained ongoing, and the notice offered a year of identity monitoring. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/el-camino-health-microsoft-365-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### El Camino Health data security notice

official · El Camino Health

<https://oag.ca.gov/system/files/El%20Camino%20-%20California%20Notification.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Occurred At · 100% confidence · current**  
   Reported unauthorized access begins: 2026-08-26
2. **Resulted In · 100% confidence · current**  
   El Camino Health Microsoft 365 incident: Unusual activity detected
3. **Resulted In · 100% confidence · current**  
   El Camino Health Microsoft 365 incident: Reported access window ends
4. **Resulted In · 100% confidence · current**  
   El Camino Health Microsoft 365 incident: El Camino Health identified unusual Microsoft 365 activity on September 1, 2026. Investigators found intermittent unauthorized access to four employee accounts from August 26 through September 2.
5. **Resulted In · 100% confidence · current**  
   El Camino Health Microsoft 365 incident: Reported unauthorized access begins
6. **Resulted In · 100% confidence · current**  
   El Camino Health Microsoft 365 incident: Documents were copied or downloaded. Potential fields included contacts, identity numbers, birth dates, patient identifiers, diagnoses, treatment, prescriptions, provider and insurance information; some patients’ bank details could also be involved.
7. **Affected Organization · 100% confidence · current**  
   El Camino Health Microsoft 365 incident: El Camino Health
8. **Discovered At · 100% confidence · current**  
   El Camino Health Microsoft 365 incident: 2026-09-01
9. **Occurred At · 100% confidence · current**  
   Reported access window ends: 2026-09-02
10. **Occurred At · 100% confidence · current**  
   Unusual activity detected: 2026-09-01
11. **Resulted In · 100% confidence · current**  
   El Camino Health Microsoft 365 incident: El Camino secured the system, engaged forensic experts, notified law enforcement and added safeguards. Document review remained ongoing, and the notice offered a year of identity monitoring.

</details>