HCA confirms breach after 11 million patient data stolen by hackers.
HCA Healthcare has disclosed a data breach affecting around 11 million patients who had received care at one of its hospitals and clinics, after a threat actor leaked samples of the stolen data to a hacking forum.
HCA Healthcare is one of the largest owners and managers of healthcare facilities in America, with 182 hospitals and 2,200 care centers in 21 states in the United States and the United Kingdom.
As first reported by DataBreaches.net on July 5, 2023, a threat actor began selling data purportedly belonging to HCA Healthcare on a forum used to sell and leak stolen data. This forum posting included samples of the stolen database, which they claimed consisted of 17 files and 27.7 million database records.
The threat actor claims that the stolen data consists of patient records created between 2021 and 2022.
The threat actor did not initially offer the database for sale, but instead used the post to blackmail HCA Healthcare, giving it until July 10 to meet its demands. This is likely related to financial demands, although it was not explicitly stated.
However, after receiving no response from HCA, the hacker began selling the full database, while other threat actors also expressed interest in purchasing the data.
The organization confirmed yesterday that the data leaked on the hacking forum is authentic, with the stolen database affecting around 11 million people.
HCA states that the data was stolen from an “external storage location” used to format patient emails.
The stolen data includes the following:
- Full names
- City, state and zip code
- Email address
- Telephone number
- Date of birth
- Sex
- Date and location of service
The aforementioned data is valuable to threat actors conducting phishing and scam attacks, who could use it to launch convincing social engineering attacks against exposed individuals.
HCA Healthcare does not believe the stolen data contains detailed clinical information, such as conditions, diagnoses and treatments, payment information, such as credit card and bank account, or other sensitive information, such as passwords, social security numbers and driver's licenses.
HCA Healthcare has notified law enforcement of the incident and is continuing to investigate whether its networks and systems are free of malicious activity that could indicate whether threat actors still have access.
Additionally, access to the compromised storage location has been disabled as an emergency containment measure, and the organization is working to implement additional security and data protection measures.
For a full list of affected facilities across the country, check the bottom of HCA Healthcare's announcement.
Information source: bleepingcomputer.com
