For roughly two years, someone outside Sutherland Healthcare Solutions was doing an employee’s job with that employee’s credentials, and the company did not know.
The revenue cycle and medical coding vendor disclosed that a staff member engaged another individual to perform their duties. That stand-in reached member names, addresses and birth dates, plus health plan and Social Security numbers, claims data and stated gender, from July 29, 2024 through July 10, 2026.
Access died once the arrangement surfaced, and affected health plans were told so they could work out who was exposed. Letters went out recently. Sutherland calls the access non-malicious and reports no misuse, offering identity protection as a precaution. How many people were affected stays undisclosed, and the HHS Office for Civil Rights breach portal carries no entry for it yet.
Hoag finds an intruder the same week
Hoag Memorial Hospital Presbyterian, a nonprofit network in Orange County, California, spotted suspicious network activity on October 8, 2026, and brought in outside forensics. Unauthorized access was confirmed.
By October 25 the review had finished, and Hoag knew that personal and protected health information was involved. Notification letters went out in early November. Publicly filed notices name neither data categories nor an affected population. Credit monitoring has been offered.
The vendor case is the more instructive one. Credential sharing between individuals is nearly invisible to identity controls because the login is valid, no password is stolen, and no malware runs. Contractors and offshore staffing arrangements are the usual setting. Detection depends on correlating behavior – device fingerprint, working hours, location and access pattern – against the account’s history rather than trusting the credential.
