Which companies just had a verified incident, who lends to them and who owns them. Every claim carries its evidence level and its source. How we decide what is confirmed
HCA Healthcare
healthcare (hospital system) · United States (Nashville, TN headquarters; HCA-affiliated facilities and physician offices; at least 15,096 Texans per a claims-site summary of the Texas filing)
What happened
Two notice templates. The first covers medical resident HR files: name, SSN, date of birth, contact details and immigration information where applicable. The second covers patient files from HCA-affiliated facilities and physician offices; the data elements are a variable field in the template. An 'unknown unauthorized party' obtained copies of the files. Law enforcement was notified.
Identity theft exposure for medical residents (including immigration data) and patients. Two years of IDX monitoring offered, enrollment by 2 Feb 2027.
What remains unknown
- total number affected nationwide
- which facilities
- initial access vector
- whether this is ransomware or extortion (no claim seen)
- whether HCA treats it as material (no 8-K found)
Losses: unknown
Capital around this company
DFX holds no verified lender or owner record for this organization yet. That is a gap in our coverage, not evidence that none exists.
Sources
- California AG data breach list (entries reported 28 to 30 Oct 2026) · 2026-10-30
- HCA Healthcare notice of data breach, individual notification templates (CA AG sb24-632064) · 2026-10-29 (letter dated 2026-11-02)
- HCA Healthcare Data Breach Impacts Patients and Employees (ClaimDepot) · 2026-10-30
Does HCA Healthcare touch your portfolio?
We map a company or a whole book against verified incidents: the lenders, owners and providers around each holding, with what is confirmed and what is not.