Personal information for potentially tens of millions of HCA Healthcare (NYSE:HCA) patients has been stolen and is now available for sale on a data breach forum as of earlier this week.
HCA, one of the largest companies in the U.S., first acknowledged the breach earlier today. In a release, it warned patients that critical personal information had been compromised, including their full name, city and when and where they last saw a provider.
Shares of the health-care giant closed up more than 1.4% in Monday trading and were unchanged after hours. They opened Tuesday up $1.47 to $296.83.
The provider claimed no clinical information had been disclosed.
But DataBreaches.net reported Monday that the unnamed hacking group provided them with a sample set of data about a patient’s “low risk” lung cancer assessment, which would apparently undercut HCA’s assessment that no material or protected health information was breached.
The hack affects patients in nearly two dozen states, including patients at dozens of facilities in Florida and Texas. The data sale was flagged on Twitter by Brett Callow, an analyst at New Zealand-based Emsisoft.
“This may be one of the biggest health care-related breaches of the year and one of the biggest of all time. That said, despite affecting millions of people, it may not be as harmful as other breaches as, based on HCA’s statement, it doesn’t seem to have impacted diagnoses or other medical information,” Callow told reporters.
