HackingData ExfiltratedCustomer Data InvolvedIDENTITY_BASICHEALTH_BASICLowContained
HCA Healthcare Inc.
bd_64b2526179555bbb · schema v1 · pii pii-v1
Full breach record for HCA Healthcare Inc. →HCA Healthcare discovered on July 5, 2023, that patient information was made available on an online platform by an unauthorized party. The data was stolen from an external storage location in late June 2023. Affected data includes names, contact info, dates of birth, and service dates, but excludes clinical or payment data. HCA disabled access to the storage location, engaged forensic advisors, and offered 2 years of credit monitoring.
California clockDiscovered Jul 5, 2023 → Notified Aug 4, 202330d ✓ CA 60-day OK27 days discovery → filing
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_9b908244a6dec321Washington State AGfiled 2023-08-01Candidate
- bd_e1ece1715cd49706Montana State AGfiled 2023-08-29(28d gap)Verified
- bd_469b4c05c3cce8b6Oregon State AGfiled 2023-08-30(29d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-571162
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 1, 2023
- Raw hash
- 8cdb101ec7837461275934f8da97b35c2ff4b7a5f81137166bcf974935dfdd11
Reporting entity
- Name
- HCA Healthcare Inc.norm: hca healthcare
- Domain
- hcahealthcare.com
Victim entity
- Name
- HCA Healthcare Inc.norm: hca healthcare
- Domain
- hcahealthcare.com
Incident
- Discovered
- Jul 5, 2023
- Materiality determined
- —
- Notification sent
- Aug 4, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICHEALTH_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Reported this event to law enforcement
Compliance
- Time to disclose
- 27 days(27 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 30d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jul 5, 2023→ Notified: Aug 4, 202330d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.