2026 HCA Healthcare — unauthorized access to the HCA Global HR website; direct-deposit details changed for some employees; SSNs and bank details exposed
Data compromised
Per the sample notice quoted by ClassAction.org: names, employee IDs, phone numbers, email addresses, home addresses, Social Security numbers, and bank account and routing numbers for affected employees. The total number affected has not been publicly disclosed.
Technical writeup
Root cause
An unauthorized party accessed the HCA Global Human Resources website on February 23, 2026. It changed direct-deposit information for some employees through fake HCA authentication portals. HCA reported the incident to the New Hampshire Attorney General on July 27, 2026, and the notice is listed as published August 5, 2026. The discovery date is not stated; the notice says only "upon learning of the incident." This is separate from the Texas patient-data filing in the existing HCA row.