October 30, 2026: El Camino Health, a hospital system in California's Santa Clara County, began mailing patients after an attacker accessed four employee Microsoft 365 accounts and copied documents. The files may include Social Security numbers, diagnoses, insurance details and, for some patients, bank account numbers. The electronic health record was not involved. Details are in the El Camino Health breach record.
El Camino Health spotted unusual activity on September 1, 2026. Its forensic investigation found that the four accounts were accessed on and off from August 26 to September 2, and that some files were copied or downloaded during that time. The hospital notified law enforcement and hired outside specialists. It has not said how the attacker got into the accounts.
The hospital has not published how many patients are affected. Letters started on October 30 while the document review was still running, so more people may be notified later.
What happened in the El Camino Health data breach?
This was an email and file-storage breach, not an attack on the hospital's clinical systems. Staff mailboxes and cloud folders often hold referral letters, billing spreadsheets and patient lists, so a small number of accounts can contain a large amount of patient data.
The hospital's substitute notice (PDF) lists the types of information found in the copied documents. Becker's Hospital Review reported the incident in early November. El Camino says it has added further technical controls but has not described them in detail.
What data was exposed?
The information varies from patient to patient. Not every field appears for every person. The notice lists:
- Identity details: names, contact information, demographics, Social Security numbers, driver licence numbers and dates of birth.
- Medical details: medical record numbers, patient account numbers, diagnoses, treatment, prescriptions, provider names and dates of service.
- Insurance and financial details: health insurance information and, for some patients, financial account and routing numbers.
A Social Security number combined with medical details can be used for medical identity theft and tax fraud. Bank routing numbers add the risk of unauthorized withdrawals. El Camino is offering Experian credit monitoring to patients whose Social Security or driver licence numbers may be involved.
Who is affected?
Affected patients are those whose information appeared in documents copied from the four accounts. Most live in Santa Clara County and the wider Bay Area, though the notice does not limit the incident to California residents. Patients who did not receive a letter in October may still get one once the review finishes.
A similar, smaller incident hit Vanderbilt Health, where an email phishing attack exposed data on 3,298 patients. That case did not involve Social Security numbers. El Camino's list of exposed fields is much wider.
What should El Camino Health patients do?
- Keep any letter you receive and enrol in the Experian monitoring it offers if your Social Security or driver licence number is listed.
- Place a free credit freeze with Equifax, Experian and TransUnion if your Social Security number may be involved.
- Read explanation-of-benefits statements from your insurer and look for services you did not receive.
- Check bank statements for withdrawals you do not recognize, especially if your letter mentions account numbers.
- Call El Camino's dedicated line at 888-517-6420, Monday to Friday, 9 a.m. to 9 p.m. Pacific, with questions.
For another recent clinic breach involving Social Security numbers, see our post on Urologic Specialists of Oklahoma.
Frequently asked questions
How many patients were affected by the El Camino Health breach?
El Camino Health has not published a number. It began mailing letters on October 30, 2026 while it was still reviewing the copied documents, so more patients may be notified later. The breach involved four employee Microsoft 365 accounts accessed between August 26 and September 2.
Were Social Security numbers exposed?
For some patients, yes. The hospital's notice lists Social Security numbers among the information found in the copied documents, along with driver licence numbers, diagnoses and insurance details. El Camino is offering Experian credit monitoring to patients whose Social Security or licence numbers may be involved.
Was El Camino Health's electronic health record hacked?
No. The hospital says the electronic health record was not involved. The attacker accessed four employee Microsoft 365 accounts, and the exposed data came from documents stored in those mailboxes and files. Those documents can still contain diagnoses and other medical details.
How do I contact El Camino Health about the breach?
El Camino Health set up a call centre at 888-517-6420. It is open Monday to Friday, 9 a.m. to 9 p.m. Pacific time, except major US holidays. Use the number printed in your letter rather than a number from an unexpected email or text.