Someone copied or downloaded documents held in those mailboxes. That review, complete as notices went out October 30, catalogued contact and demographic data, Social Security and driver’s licence numbers, birth dates, medical record and patient account numbers, diagnoses, treatment and prescription details, provider names, service dates and insurance information. Bank account and routing numbers were also exposed for some patients.
The health system said its electronic health record was not involved. That distinction matters legally and practically: an email compromise is still a PHI breach under HIPAA, and the notification obligation runs from discovery, not from the day the mailbox was first touched.
Mailbox-level intrusions remain the most common route to patient data at health systems because email holds far more than clinicians realize, including attachments exported from the record. Tokens stolen through adversary-in-the-middle phishing sidestep passwords entirely. Conditional access rules, session limits, and mailbox audit logging catch these windows faster than a forensic bill does.
The filings cover more than this one system. HCA operates 189 hospitals and roughly 2,600 ambulatory sites across 19 states, and the incident was first identified on August 12, 2026, with the forensic review confirming unauthorized access to certain IT systems that day. HCA says the threat actor took copies of HR files holding medical resident details: names, birth dates, email addresses, phone numbers, Social Security numbers and immigration information. Patient data tied to certain affiliated facilities and physician offices was also caught up in the same intrusion.
