Data Breaches Announced by HCA Healthcare; Blossom Health
Data breaches have been announced by HCA Healthcare, Blossom Health, El Camino Health, and University of Mississippi Medical Center.
HCA Healthcare Inc.
Nashville, Tennessee-based HCA Healthcare Inc., the operator of 189 hospitals and approximately 2,600 ambulatory sites of care in 19 U.S. states, has disclosed a cybersecurity incident that was first identified on August 12, 2026. Patient and employee data were compromised in the incident.
Suspicious activity was identified within certain IT systems, and the forensic investigation confirmed unauthorized access to those systems on August 12, 2026. HCA Healthcare confirmed that the threat actor obtained copies of certain HR files containing medical resident personal information. The review of the impacted files confirmed that they contained information related to employment, including name, date of birth, email address, phone number, Social Security number, and immigration information.
Avail of a Free 30-Minute
Cybersecurity Consultation
with Blue Team Alpha
Review your security program, get advice on a specific cybersecurity concern, identify risk-reduction priorities, or take the first step toward your annual HIPAA Security Risk Assessment.
Learn More About This Offer
Patient data was also compromised related to certain affiliated facilities and physician offices. Patient data exposed in the incident included names, email addresses, phone numbers, dates of birth, Social Security numbers, medical information, and health insurance information. The number of affected patients has yet to be disclosed, although 15,096 Texas residents are known to have been affected. The affected individuals have been offered two years of complimentary credit monitoring services.
Blossom Health
Blossom BH Opco Inc., an online telepsychiatry and virtual mental health provider that does business as Blossom Health, has started notifying certain patients about an August 2026 data security incident involving unauthorized access to its electronic health record (EHR) software. According to its October 29, 2026, notification letters, an unauthorized actor gained access to the EHR software and patient data via a phishing attack on a non-employee contractor.
The incident has been investigated, and Blossom Health confirmed that the exposed information included names, contact information, and health insurance information. Blossom Health said financial information and Social Security numbers were not accessible. In its website regulatory disclosure, Blossom Health confirmed that the threat actor downloaded a limited number of patient medical records and a user spreadsheet containing patient information.
The unauthorized access has been blocked, user passwords have been changed, and additional technical security measures have been deployed to reduce the risk of similar incidents in the future. As a precaution against identity theft and fraud, the affected individuals have been offered complimentary single-bureau credit report, credit score, and credit monitoring services. The Texas Attorney General was informed that 2,103 Texas residents have been affected, although the total number of affected individuals has yet to be disclosed.
El Camino Health
El Camino Health, a non-profit health system serving Santa Clara County and the Bay Area in California, has confirmed that an unauthorized individual gained access to its Microsoft 365 environment. Suspicious activity was identified on September 1, 2026, and the forensic investigation confirmed unauthorized access to four Microsoft 365 accounts, which were intermittently accessed between August 26, 2026, and September 2, 2026. Certain documents within those accounts were copied or downloaded.
The review of the affected files has been completed, and they were found to contain contact information, demographic information, Social Security numbers, driver’s license numbers, dates of birth, medical record numbers, patient account numbers, diagnoses, treatment information, prescription information, provider names, dates of service, and health insurance information. A subset of patients also had financial account and routing numbers compromised in the incident.
El Camino Health has implemented additional protection and monitoring measures to reduce the risk of similar incidents in the future, and the affected individuals have been offered complimentary credit monitoring and identity theft protection services. The number of affected individuals has not yet been publicly disclosed.
University of Mississippi Medical Center
University of Mississippi Medical Center (UMMC) has started notifying certain patients about unauthorized access to its computer systems. The unauthorized access was identified on February 19, 2026. Third-party cybersecurity experts were engaged to assist with the investigation, and on October 20, 2026, it was confirmed that its network was subject to unauthorized access between February 11, 2026, and February 19, 2026.
UMMC has reviewed the exposed files, but its notice to the California Attorney General does not include details of the types of data involved or the number of affected individuals. There is currently no substitute data breach notice on the UMMC website. This appears to have been a ransomware attack. The Medusa ransomware group claimed responsibility for the attack in March 2026 and demanded payment to prevent the sale or release of the stolen data. The ransom was not paid.
