Four Healthcare Organizations Disclose Separate Data Breaches: HCA Healthcare, Blossom Health, El Camino Health, UMMC
HIPAA Journal reports four separate healthcare data breach disclosures. HCA Healthcare confirmed unauthorized access to IT systems on August 12, 2026, exposing HR files on medical residents and patient data (names, SSNs, medical and insurance information) at affiliated facilities; at least 15,096 Texas residents are confirmed affected. Blossom Health, a telepsychiatry provider, disclosed that a phishing attack against a non-employee contractor led to unauthorized access to its EHR software in August 2026, with a threat actor downloading patient medical records and a user spreadsheet; 2,103 Texas residents are confirmed affected. El Camino Health confirmed an unauthorized individual accessed four Microsoft 365 accounts between August 26 and September 2, 2026, exposing SSNs, driver's license numbers, medical and financial account data for a subset of patients. University of Mississippi Medical Center (UMMC) disclosed a network intrusion between February 11-19, 2026, which the Medusa ransomware group claimed responsibility for in March 2026; UMMC did not pay the ransom and has not disclosed the data types or number of victims affected.
Detalhes técnicos
- HCA Healthcare: unauthorized access identified August 12, 2026; compromised HR files (medical resident PII, SSNs, immigration information) and patient data (names, SSNs, medical/insurance information) across affiliated facilities.
- Blossom Health: initial access via phishing of a non-employee contractor; EHR software and patient spreadsheet accessed; financial data and SSNs reportedly not exposed.
- El Camino Health: compromise of four Microsoft 365 accounts, intermittent access from August 26 to September 2, 2026; exposed data includes SSNs, driver's license numbers, medical record numbers, and for some patients, bank account/routing numbers.
- UMMC: network intrusion February 11-19, 2026, identified February 19, confirmed by third-party forensics on October 20, 2026; Medusa ransomware group claimed the attack in March 2026.
Remediação
HCA Healthcare and Blossom Health are offering affected individuals credit monitoring services; El Camino Health is providing credit monitoring and identity theft protection. Blossom Health reset user passwords and added technical security measures. UMMC did not pay the ransom demand; it has not published a substitute breach notice detailing scope or data types.
Linha do tempo
-
Four Healthcare Organizations Disclose Separate Data Breaches: HCA Healthcare, Blossom Health, El Camino Health, UMMC
ler a análise desta fonte ocultar
HIPAA Journal reports four separate healthcare data breach disclosures. HCA Healthcare confirmed unauthorized access to IT systems on August 12, 2026, exposing HR files on medical residents and patient data (names, SSNs, medical and insurance information) at affiliated facilities; at least 15,096 Texas residents are confirmed affected. Blossom Health, a telepsychiatry provider, disclosed that a phishing attack against a non-employee contractor led to unauthorized access to its EHR software in August 2026, with a threat actor downloading patient medical records and a user spreadsheet; 2,103 Texas residents are confirmed affected. El Camino Health confirmed an unauthorized individual accessed four Microsoft 365 accounts between August 26 and September 2, 2026, exposing SSNs, driver's license numbers, medical and financial account data for a subset of patients. University of Mississippi Medical Center (UMMC) disclosed a network intrusion between February 11-19, 2026, which the Medusa ransomware group claimed responsibility for in March 2026; UMMC did not pay the ransom and has not disclosed the data types or number of victims affected.
Technical Details
- HCA Healthcare: unauthorized access identified August 12, 2026; compromised HR files (medical resident PII, SSNs, immigration information) and patient data (names, SSNs, medical/insurance information) across affiliated facilities.
- Blossom Health: initial access via phishing of a non-employee contractor; EHR software and patient spreadsheet accessed; financial data and SSNs reportedly not exposed.
- El Camino Health: compromise of four Microsoft 365 accounts, intermittent access from August 26 to September 2, 2026; exposed data includes SSNs, driver's license numbers, medical record numbers, and for some patients, bank account/routing numbers.
- UMMC: network intrusion February 11-19, 2026, identified February 19, confirmed by third-party forensics on October 20, 2026; Medusa ransomware group claimed the attack in March 2026.
Remediation
HCA Healthcare and Blossom Health are offering affected individuals credit monitoring services; El Camino Health is providing credit monitoring and identity theft protection. Blossom Health reset user passwords and added technical security measures. UMMC did not pay the ransom demand; it has not published a substitute breach notice detailing scope or data types.