Short answer
El Camino Health, a nonprofit health system in Silicon Valley, says it found unusual activity in its Microsoft 365 system on 1 September 2026. Four employee accounts were accessed between 26 August and 2 September, and documents were copied or downloaded. Its electronic health record system was not involved.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | El Camino Health |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Healthcare (nonprofit health system) |
| Country | United States |
| Detected | 2026-09-01 |
| Disclosed | 2026-10-30 |
| People or records affected | Not stated by El Camino Health; review of the documents is ongoing |
What data was exposed
- Names, contact and demographic information, dates of birth
- Social Security numbers and driver's license numbers
- Medical record numbers, patient account numbers, diagnosis, treatment and prescription information, provider names, dates of service
- Health insurance information, and for some patients financial account and routing numbers
What happened
El Camino Health is a nonprofit health system serving Santa Clara County and the wider Bay Area. In a notice posted on its site, it says it identified unusual activity in its Microsoft 365 system on 1 September 2026, secured the system, and began an investigation with third-party forensic experts. It also notified law enforcement.
The investigation found intermittent unauthorized access to the Microsoft 365 accounts of four employees between 26 August and 2 September 2026. Certain documents were copied or downloaded from those accounts. El Camino then began reviewing the documents to see what they contained. That review is still running.
What data was involved
The notice says the information varies by person and may include names, contact and demographic details, Social Security numbers, driver’s license numbers, dates of birth, medical record and patient account numbers, diagnosis, treatment and prescription information, provider names, dates of service and health insurance information. For some patients, financial account and routing numbers may also be involved.
Letters began going out on 30 October 2026. HIPAA Journal reported the incident on 4 November and notes the number affected has not been made public.
What El Camino has done
It added safeguards and monitoring to its Microsoft 365 system and opened a toll-free call center on 888-517-6420 (Monday to Friday, 9 a.m. to 9 p.m. Pacific). It is offering Experian credit monitoring and identity theft protection to people whose Social Security or driver’s license numbers may be involved.
What is still unknown
- how many patients are affected;
- how the accounts were accessed (the notice does not say);
- whether any of the copied documents have been published or sold.
Staying safe
Details such as a diagnosis, a prescription or a visit date make a scam call sound real. Our guide to phishing messages shows how to check a sender, and what to do after a data breach covers freezes and monitoring. If a message claims to be from a government agency, see government impersonation scams.
More recent incidents are on the breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake 'El Camino Health' texts or emails offering credit monitoring through an unfamiliar link
- Callers who quote a diagnosis, prescription or visit date to sound like a clinic or insurer
- Bank or fraud-department scams that cite a financial account number
- Medical billing scams demanding payment for services you did not receive
What to do if you are affected
- 01Watch for a letter from El Camino Health. The notice says more letters will follow as the document review finishes.
- 02If your letter offers Experian monitoring, enrol using the code in the letter, not through a message you did not expect.
- 03Review statements from your providers and insurers. If one lists services you did not receive, contact that provider or insurer.
- 04If a financial account number may be involved, review account statements and tell your bank about anything suspicious.
- 05Consider a credit freeze, and call El Camino Health's call center (888-517-6420) or its official number to check a message before replying.
Frequently asked questions
Was El Camino Health's patient record system hacked?
No, according to El Camino Health. Its notice says the electronic health record system was not involved. The documents came from four employee Microsoft 365 accounts.
When did the unauthorized access happen?
The notice says intermittent access occurred between 26 August and 2 September 2026, and the unusual activity was identified on 1 September.
How many patients were affected?
El Camino Health has not published a number. It says its review of the copied documents is ongoing and more letters will be mailed.
What help is offered?
Credit monitoring and identity theft protection through Experian for people whose Social Security or driver's license numbers may be involved.
Has anyone claimed the attack?
We found no claim tied to this 2026 incident in the sources reviewed.
Sources
- El Camino Health Addresses a Data Security Incident, El Camino Health (substitute notice), 2026-10-30
- Data Breaches Announced by HCA Healthcare, Blossom Health, El Camino Health and UMMC, HIPAA Journal, 2026-11-04
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.