---
title: "HCA Healthcare medical-resident data incident"
description: "HCA Healthcare detected suspicious activity on August 12, 2026, and determined that an unauthorized party copied files containing medical-resident information that day."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-04"
canonical_url: "https://www.ally.security/incidents/hca-healthcare-medical-resident-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/hca-healthcare-medical-resident-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/hca-healthcare-medical-resident-data-incident-2026/stix.json"
---

# HCA Healthcare medical-resident data incident

HCA Healthcare detected suspicious activity on August 12, 2026, and determined that an unauthorized party copied files containing medical-resident information that day.

Last modified Nov 4, 2026 · 1 source

## Summary

- **Environment:** IT systems holding medical-resident HR files
- **Operational impact:** Medical-resident employment data copied
- **Financial impact:** No incident cost disclosed

## What happened

[HCA Healthcare](https://hcahealthcare.com/) detected suspicious activity on August 12, 2026, and determined that an unauthorized party copied files containing medical-resident information that day. [1](#source-1)

## Impact

The files contained names, Social Security numbers, birth dates, personal contacts and immigration information where applicable. [1](#source-1)

HCA reported no indication of publication, further disclosure, unauthorized transactions or identity theft at the time of its notice. [1](#source-1)

## Timeline

### August 12, 2026 — Intrusion and file copying identified

Intrusion and file copying identified, according to the published account. [Incident notice](https://oag.ca.gov/system/files/HCA%20Healthcare%20-%20Notice%20of%20Data%20Breach%20-%20Individual%20Notification%20Templates.pdf). [1](#source-1)

### November 2, 2026 — Resident notification letter dated

Resident notification letter dated, according to the published account. [Incident notice](https://oag.ca.gov/system/files/HCA%20Healthcare%20-%20Notice%20of%20Data%20Breach%20-%20Individual%20Notification%20Templates.pdf). [1](#source-1)

### November 4, 2026 — Briefing updated

This briefing was last reviewed and updated on November 4, 2026.

## Threat Group & Attack Vector

The reviewed notice does not establish the initial access method.

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

HCA secured systems, engaged cybersecurity specialists, notified law enforcement and offered two years of identity protection. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/hca-healthcare-medical-resident-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### HCA Healthcare data security notice

official · HCA Healthcare · Nov 2, 2026

<https://oag.ca.gov/system/files/HCA%20Healthcare%20-%20Notice%20of%20Data%20Breach%20-%20Individual%20Notification%20Templates.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Discovered At · 100% confidence · current**  
   HCA Healthcare medical-resident data incident: 2026-08-12
2. **Resulted In · 100% confidence · current**  
   HCA Healthcare medical-resident data incident: Intrusion and file copying identified
3. **Resulted In · 100% confidence · current**  
   HCA Healthcare medical-resident data incident: HCA secured systems, engaged cybersecurity specialists, notified law enforcement and offered two years of identity protection.
4. **Resulted In · 100% confidence · current**  
   HCA Healthcare medical-resident data incident: The files contained names, Social Security numbers, birth dates, personal contacts and immigration information where applicable.
5. **Affected Organization · 100% confidence · current**  
   HCA Healthcare medical-resident data incident: HCA Healthcare
6. **Resulted In · 100% confidence · current**  
   HCA Healthcare medical-resident data incident: Resident notification letter dated
7. **Resulted In · 100% confidence · current**  
   HCA Healthcare medical-resident data incident: HCA Healthcare detected suspicious activity on August 12, 2026, and determined that an unauthorized party copied files containing medical-resident information that day.
8. **Resulted In · 100% confidence · current**  
   HCA Healthcare medical-resident data incident: HCA reported no indication of publication, further disclosure, unauthorized transactions or identity theft at the time of its notice.
9. **Occurred At · 100% confidence · current**  
   Resident notification letter dated: 2026-11-02
10. **Occurred At · 100% confidence · current**  
   Intrusion and file copying identified: 2026-08-12

</details>