Incident BriefingsHCA Healthcare medical-resident data incident

HCA Healthcare medical-resident data incident

HCA Healthcare detected suspicious activity on August 12, 2026, and determined that an unauthorized party copied files containing medical-resident information that day.

Last modified

Summary

  • Environment: IT systems holding medical-resident HR files
  • Operational impact: Medical-resident employment data copied
  • Financial impact: No incident cost disclosed
  • Record status: Developing record. Reviewed November 4, 2026; updated as evidence emerges.

What happened

HCA Healthcare detected suspicious activity on August 12, 2026, and determined that an unauthorized party copied files containing medical-resident information that day. [1]

Impact

The files contained names, Social Security numbers, birth dates, personal contacts and immigration information where applicable. [1]

HCA reported no indication of publication, further disclosure, unauthorized transactions or identity theft at the time of its notice. [1]

Timeline

  1. Intrusion and file copying identified

    Intrusion and file copying identified, according to the published account. Incident notice.

    [1]

  2. Resident notification letter dated

    Resident notification letter dated, according to the published account. Incident notice.

    [1]

  3. Briefing updated

    This briefing was last reviewed and updated on November 4, 2026.

Threat Group & Attack Vector

The reviewed notice does not establish the initial access method.

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

  • No specific MITRE ATT&CK technique is currently mapped for this case.

Response

HCA secured systems, engaged cybersecurity specialists, notified law enforcement and offered two years of identity protection. [1]