HCA Healthcare on Monday announced that the personal information of roughly 11 million patients was stolen in a data breach.
The incident, the healthcare services provider says, was discovered on July 5, after a threat actor posted on an underground forum information allegedly stolen from HCA Healthcare.
The threat actor posted a list containing names, addresses, birth dates, gender information, phone numbers, email addresses, service dates, and appointment dates, HCA Healthcare says in an incident notice.
“The investigation is ongoing and we cannot confirm the number of individuals whose information was impacted. HCA Healthcare believes that the list contains approximately 27 million rows of data that may include information for approximately 11 million HCA Healthcare patients,” the company says.
The information was extracted from “an external storage location exclusively used to automate the formatting of email messages”.
According to the healthcare services provider, clinical information, payment information, or other sensitive information (such as passwords, Social Security numbers, and driver’s license numbers) was not stolen in the attack.
According to DataBreaches.net, however, the hackers claim to be in the possession of emails containing “health diagnosis that correspond to a client ID”.
HCA Healthcare also says that it disabled user access to the compromised storage location immediately after discovering the data breach and that it has found no evidence of malicious activity on its network or systems.
“There has been no disruption to the care and services HCA Healthcare provides to patients and communities. This incident has not caused any disruption to the day-to-day operations of HCA Healthcare,” the company says.
HCA Healthcare has informed law enforcement of the incident and plans to contact the impacted individuals, but believes that the incident will not have a material impact.
One of the largest healthcare services providers in the US, HCA Healthcare operates 180 hospitals and more than 2,300 ambulatory sites of care across 20 states and the United Kingdom.
Related: 28,000 Impacted by Data Breach at Pepsi Bottling Ventures
Related: American Airlines, Southwest Airlines Impacted by Data Breach at Third-Party Provider
Related: Intellihartx Informs 490k Patients of GoAnywhere-Related Data Breach