---
title: "Hoag Hospital network-file incident"
description: "Hoag Memorial Hospital Presbyterian detected suspicious network activity on October 8, 2026. Its investigation found that certain files may have been accessed without authorization."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-06"
canonical_url: "https://www.ally.security/incidents/hoag-hospital-network-file-incident-2026"
markdown_url: "https://www.ally.security/incidents/hoag-hospital-network-file-incident-2026.md"
stix_url: "https://www.ally.security/incidents/hoag-hospital-network-file-incident-2026/stix.json"
---

# Hoag Hospital network-file incident

Hoag Memorial Hospital Presbyterian detected suspicious network activity on October 8, 2026. Its investigation found that certain files may have been accessed without authorization.

Last modified Nov 6, 2026 · 1 source

## Summary

- **Environment:** Hospital network files
- **Operational impact:** Personal and health information potentially accessed
- **Financial impact:** No incident cost publicly quantified

## What happened

[Hoag Memorial Hospital Presbyterian](https://www.hoag.org/) detected suspicious network activity on October 8, 2026. Its investigation found that certain files may have been accessed without authorization. [1](#source-1)

## Impact

The potentially affected files contained personal or protected health information. The public sample identifies names but leaves the other recipient-specific data elements unspecified; it gives no affected-person total. [1](#source-1)

## Timeline

### October 8, 2026 — Suspicious network activity detected

Suspicious network activity detected, as described in the [incident notice](https://oag.ca.gov/system/files/Hoag%20Hospital%20-%20CA%20Regulatory%20Notice%20Letter%2815618477.1%29_0.pdf). [1](#source-1)

### October 25, 2026 — Personal-information review completed

Personal-information review completed, as described in the [incident notice](https://oag.ca.gov/system/files/Hoag%20Hospital%20-%20CA%20Regulatory%20Notice%20Letter%2815618477.1%29_0.pdf). [1](#source-1)

### November 4, 2026 — Notification letter dated

Notification letter dated, as described in the [incident notice](https://oag.ca.gov/system/files/Hoag%20Hospital%20-%20CA%20Regulatory%20Notice%20Letter%2815618477.1%29_0.pdf). [1](#source-1)

### November 6, 2026 — Briefing updated

This briefing was last reviewed and updated on November 6, 2026.

## Threat Group & Attack Vector

The reviewed notice does not establish the initial access method.

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Hoag engaged independent forensic experts, secured its environment and added safeguards. An October 25 file review identified potentially affected personal information, and its November 4 letter offered credit monitoring and identity protection. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/hoag-hospital-network-file-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Hoag Memorial Hospital Presbyterian — Notice of Data Security Incident

official · Hoag Memorial Hospital Presbyterian · Nov 4, 2026

<https://oag.ca.gov/system/files/Hoag%20Hospital%20-%20CA%20Regulatory%20Notice%20Letter%2815618477.1%29_0.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Hoag Hospital network-file incident: Notification letter dated
2. **Resulted In · 100% confidence · current**  
   Hoag Hospital network-file incident: Hoag engaged independent forensic experts, secured its environment and added safeguards. An October 25 file review identified potentially affected personal information, and its November 4 letter offered credit monitoring and identity protection.
3. **Occurred At · 100% confidence · current**  
   Notification letter dated: 2026-11-04
4. **Discovered At · 100% confidence · current**  
   Hoag Hospital network-file incident: 2026-10-08
5. **Resulted In · 100% confidence · current**  
   Hoag Hospital network-file incident: The potentially affected files contained personal or protected health information. The public sample identifies names but leaves the other recipient-specific data elements unspecified; it gives no affected-person total.
6. **Resulted In · 100% confidence · current**  
   Hoag Hospital network-file incident: Personal-information review completed
7. **Resulted In · 100% confidence · current**  
   Hoag Hospital network-file incident: Hoag Memorial Hospital Presbyterian detected suspicious network activity on October 8, 2026. Its investigation found that certain files may have been accessed without authorization.
8. **Occurred At · 100% confidence · current**  
   Personal-information review completed: 2026-10-25
9. **Affected Organization · 100% confidence · current**  
   Hoag Hospital network-file incident: Hoag Memorial Hospital Presbyterian
10. **Resulted In · 100% confidence · current**  
   Hoag Hospital network-file incident: Suspicious network activity detected
11. **Occurred At · 100% confidence · current**  
   Suspicious network activity detected: 2026-10-08

</details>