Short answer
HCA Healthcare told affected people that it spotted suspicious activity on 12 August 2026 and that an unknown party copied files containing medical resident HR information. Reporting based on state filings says some patient data was also involved. HCA has not published a national total.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | HCA Healthcare, Inc. |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Healthcare (hospital operator) |
| Country | United States |
| Detected | 2026-08-12 |
| Disclosed | 2026-10-29 |
| People or records affected | Not disclosed nationally; at least 15,096 Texas residents according to the Texas Attorney General listing as reported by HIPAA Journal |
What data was exposed
- Medical residents: name, Social Security number, date of birth, personal email address, phone number and immigration information where applicable
- Patients at some affiliated facilities and physician offices: name, contact details, date of birth, Social Security number, medical information and health insurance information
What happened
HCA Healthcare operates hospitals and clinics across the United States. In a notice of data breach dated 2 November 2026 and filed with the California Attorney General, the company says it identified suspicious activity involving certain IT systems on 12 August 2026. It secured the systems, started an investigation with outside cybersecurity experts and notified law enforcement.
The investigation concluded that an unknown unauthorized party gained access on that same date and obtained copies of certain files. The California listing records the breach date as 12 August 2026 and the report date as 29 October 2026.
What was taken
The letter I reviewed is the version sent to medical residents. It says the files held Human Resources information that residents had provided in connection with their employment: name, Social Security number, date of birth, contact details including personal email address and phone number, and immigration information where applicable.
The HIPAA Journal, reporting on 4 November, says patient information at certain affiliated facilities and physician offices was also affected. For patients it lists names, contact details, dates of birth, Social Security numbers, medical information and health insurance information. That patient notice was not among the documents reviewed for this post, so the patient detail rests on the HIPAA Journal report.
How many people
HCA has not published a total. The HIPAA Journal reports that 15,096 Texas residents are known to be affected, based on the state’s breach listing. Other numbers have appeared in coverage, but they could not be matched to an HCA statement, so treat any larger figure as unconfirmed. This incident is separate from the July 2023 HCA data theft that involved about 11 million patients.
What HCA is offering
The sample letter offers two years of complimentary identity protection through IDX, with credit and dark web monitoring, a 1,000,000 dollar reimbursement policy and managed restoration. HCA says it has no indication the data has been published, further disclosed or used for identity theft. The enrollment deadline is 2 February 2027, and the letter gives a phone line of 1-866-200-0915.
Scams to expect
A stolen Social Security number is the main risk for residents and patients alike. Be careful with any message that mentions IDX, HCA or this breach and then asks for your number, a payment or a login. Read our data breach checklist for the order of steps, and our guide to phishing messages for how to spot a lookalike enrollment link. If a caller claims to be from your hospital or insurer, hang up and call the number on your card, as covered in vishing and callback phone scams.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake 'HCA identity protection' emails, texts or calls that ask for your Social Security number to 'complete enrollment'.
- Identity theft attempts that use a stolen Social Security number to open credit accounts or file false tax returns.
- Medical or insurance fraud calls from someone who already knows your provider and asks you to 'confirm' account details.
- Employment and immigration scams aimed at medical residents, such as fake visa or licensing fee demands.
What to do if you are affected
- 01Enroll only through the code and the address printed in your letter. The sample letter lists an enrollment deadline of 2 February 2027 and a phone line at 1-866-200-0915.
- 02Check your credit reports at annualcreditreport.com and place a fraud alert or free credit freeze with the three bureaus.
- 03Read insurance explanation-of-benefits statements for services you did not receive.
- 04If you file taxes in the US, ask the IRS about an Identity Protection PIN to block false returns.
- 05Do not give your Social Security number to anyone who contacts you first, even if they cite this breach.
Frequently asked questions
What did HCA Healthcare say happened?
The letter says HCA identified suspicious activity involving certain IT systems on 12 August 2026, secured the systems, hired outside experts and notified law enforcement. It found that an unknown party gained access that day and obtained copies of files holding medical resident personal information.
What information was involved?
For medical residents, HCA's letter lists name, Social Security number, date of birth, contact details including personal email and phone, and immigration information where applicable. The HIPAA Journal reports that patient data at some affiliated facilities and physician offices was also involved, including medical and health insurance information.
How many people are affected?
HCA has not published a national total. The HIPAA Journal reports that 15,096 Texas residents are known to be affected. Other figures in circulation have not been confirmed against an HCA statement.
Is HCA offering protection?
Yes. The sample letter offers two years of identity theft protection through IDX, including credit and dark web monitoring, a 1,000,000 dollar insurance reimbursement policy and identity restoration help. The enrollment deadline in the letter is 2 February 2027.
Has the data been misused?
HCA's letter says it has no indication that the data has been published, further disclosed or used for unauthorized transactions or identity theft.
Sources
- Notice of Data Breach, individual notification template (dated 2 November 2026), HCA Healthcare via California Attorney General, 2026-11-02
- Report listing for HCA Healthcare, Inc. (breach date 12 August 2026), California Attorney General, 2026-10-29
- Data Breaches Announced by HCA Healthcare and Blossom Health, The HIPAA Journal, 2026-11-04
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.