Sam Hazen, CEO of HCA Healthcare, speaks with respect to Covid-19 in the Rose Garden of the White House in Washington, D.C., April 14, 2020.
Alex Brandon | AP
Personal information for potentially tens of millions of HCA Healthcare patients has been stolen and is now ready for sale on a data breach forum as of earlier this week.
HCA, one of the largest companies in the U.S., first acknowledged the breach earlier today. In a saving, it warned patients that critical personal information had been compromised, including their full name, bishopric and when and where they last saw a provider.
Shares of the health-care giant closed up more than 1.4% in Monday patronage and were unchanged after hours.
The provider claimed no clinical information had been disclosed.
But DataBreaches.net reported Monday that the unnamed palfrey group provided them with a sample set of data about a patient’s “low risk” lung cancer assessment, which would manifestly undercut HCA’s assessment that no material or protected health information was breached.
The hack affects patients in nearly two dozen states, covering patients at dozens of facilities in Florida and Texas. The data sale was flagged on Twitter by Brett Callow, an analyst at New Zealand-based Emsisoft.
“This may be one of the biggest haleness care-related breaches of the year and one of the biggest of all time. That said, despite affecting millions of people, it may not be as harmful as other holes as, based on HCA’s statement, it doesn’t seem to have impacted diagnoses or other medical information,” Callow told CNBC.
“The hacker has, in any way, claimed to have ’emails with health diagnosis that correspond to a clientID,'” Callow noted.
Case data breaches are not uncommon, but they can vary in scope and effect. HCA’s breach did not apparently include critical medical take downs, and the company said the breached data originated at an “external storage location exclusively used to automate the formatting of email words.”