HCA Healthcare disclosed a data breach impacting an estimated 11 million patients who received care at one of its hospitals and clinics after a threat actor leaked samples of the stolen data on a hacking forum.
HCA Healthcare is one of America's largest healthcare facility owners and operators, with 182 hospitals and 2,200 care centers across 21 U.S. states and the United Kingdom.
As first reported by
DataBreaches.net, on July 5th, 2023, a threat actor began selling data allegedly belonging to HCA Healthcare on a forum used to sell and leak stolen data. This forum post includes samples of the stolen database, which they claim consists of 17 files and 27.7 million database records.
The threat actor claims that the stolen data consists of patient records created between 2021 and 2023.
The threat actor initially did not offer the database for sale but instead used the post to blackmail HCA Healthcare, giving them until July 10th to" "meet the demands." This is likely related to financial demands, although it wasn't explicitly mentioned.
However, after not receiving a response from HCA, the hacker began selling the full database, with other threat actors expressing interest in purchasing the data.
