HCA Healthcare Inc.

HCA Healthcare reported a data breach to the Oregon Attorney General. The breach was reported on 2023-08-30. The breach occurred during 6/30/2023. The breach was discovered on 7/5/2023. Notice was sent on 7/10/2023.

HCA Healthcare reported a data breach to the Montana Attorney General. The breach was reported on 2023-08-29. The breach occurred on 7/10/2023. 1,700 Montana residents were affected.

HCA Healthcare discovered on July 5, 2023, that patient information was made available on an online platform by an unauthorized party. The data was stolen from an external storage location in late June 2023. Affected data includes names, contact info, dates of birth, and service dates, but excludes clinical or payment data. HCA disabled access to the storage location, engaged forensic advisors, and offered 2 years of credit monitoring.

HCA Healthcare, a health sector entity reported a theft or mistake incident to the Washington Attorney General. The organization became aware of the incident on 2023-07-05 and filed notice on 2023-08-01. 7,500 Washington residents were affected. 27 days elapsed between awareness and notification. 6 days to identify the breach. 0 days to contain the breach.

Delaware Attorney General received a breach notification from HCA Healthcare regarding a ransomware incident. The breach involved the encryption and exfiltration of patient data, with demands placed on the organization. The incident is classified as active, involving external actors with financial motives.

On July 10, 2023, HCA Healthcare, Inc. furnished an Item 8.01 Form 8-K reporting a data security incident and incorporating by reference a same-day press release (Exhibit 99.1). The 8-K body itself does not describe the nature of the incident, the threat actor, affected individual counts, data categories, or response actions; those details would be contained in the referenced press release, which is not included in this filing body.

HealthCare, Inc., a health sector entity reported a unclear/unknown incident to the Washington Attorney General. The organization became aware of the incident on 2021-11-03 and filed notice on 2021-12-01. 625 Washington residents were affected. 28 days elapsed between awareness and notification. 45 days to identify the breach. 0 days to contain the breach.