---
title: "HCA Healthcare security incident"
description: "What the retained public evidence establishes about the HCA Healthcare incident, its attack path, impact, and response."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-09-19"
canonical_url: "https://www.ally.security/incidents/hca-healthcare-security-incident-2023"
markdown_url: "https://www.ally.security/incidents/hca-healthcare-security-incident-2023.md"
stix_url: "https://www.ally.security/incidents/hca-healthcare-security-incident-2023/stix.json"
---

# HCA Healthcare security incident

The retained public source describes the HCA Healthcare incident as Data theft from external storage location (not ransomware). Other material details remain unresolved.

Last modified Sep 19, 2026 · 1 source

## Summary

- **Environment:** Hospital system
- **Operational impact:** The reviewed source does not establish a precise operational or data impact
- **Financial impact:** No financial figure is established by the reviewed source evidence

## What happened

In 2023, HCA Healthcare experienced an incident in its hospital system environment. The retained source describes the attack path as follows: Data theft from external storage location (not ransomware). [1](#source-1)

## Impact

- The reviewed source does not establish a precise affected-person count, data scope, or operational consequence.
- No financial loss, ransom amount, recovery cost, or regulatory penalty is established by the reviewed source evidence.

## Threat Group & Attack Vector

The retained source describes the attack path as follows: Data theft from external storage location (not ransomware). The canonical record does not add intrusion steps beyond those supported by the source. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- [T1486 — Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486/) — mapped from the cited behavior. [1](#source-1)

## Response

The reviewed source does not describe containment, notification, or restoration steps in enough detail to summarize them responsibly.

This account is bounded to [HCA Healthcare Form 8-K](https://www.sec.gov/Archives/edgar/data/860730/000119312523184269/d522417d8k.htm). Details absent from that evidence are left unresolved rather than inferred. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/hca-healthcare-security-incident-2023/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### HCA Healthcare Form 8-K

regulatory · U.S. Securities and Exchange Commission

<https://www.sec.gov/Archives/edgar/data/860730/000119312523184269/d522417d8k.htm>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   HCA Healthcare security incident: The reviewed source documents the hca healthcare security incident involving HCA Healthcare.
2. **Resulted In · 83% confidence · current**  
   HCA Healthcare security incident: Data theft from external storage location (not ransomware).
3. **Affected Organization · 100% confidence · current**  
   HCA Healthcare security incident: HCA Healthcare
4. **Used Attack Technique · 90% confidence · current**  
   HCA Healthcare security incident: https://attack.mitre.org/techniques/T1486/

</details>