HCA Healthcare, a Nashville-based private network of hospitals and healthcare facilities, suffered a criminal cyberattack in 2023 that resulted in a severe data breach. The attackers obtained the personal data of 3.6 million patients, exposing them to risks of identity theft and fraud. The breach led to a class-action lawsuit, where plaintiffs argued that HCA Healthcare failed to prevent the attack, leaving patients vulnerable. While HCA denied the allegations, it agreed to an undisclosed settlement, offering affected patients one year of free credit monitoring, insurance services, and cash payments up to $5,000 for documented losses (e.g., fraudulent charges, credit expenses). The breach was publicly disclosed around July 10, 2023, and eligible claimants had until September 25, 2025, to file for compensation. The incident underscores the critical vulnerabilities in healthcare data security and the financial and reputational repercussions of large-scale patient data exposure.

HCA Healthcare Inc. faced a significant data breach in 2023, exposing the personal information of approximately 11 million patients. The breach led to a class-action lawsuit alleging negligence in safeguarding sensitive data. As part of the settlement, affected individuals became eligible for up to $5,000 in reimbursement for documented financial losses tied to the incident, along with one year of free credit-monitoring services. The breach compromised patient records, raising concerns over identity theft, financial fraud, and unauthorized access to medical histories. The federal court’s approval of the settlement underscores the severity of the exposure, particularly given the scale of impacted individuals and the potential long-term repercussions for victims, including reputational harm to HCA and erosion of patient trust in healthcare data security.