HCA Data Leak Affects 11 Million; Class Action Says 9 Million Hit by Dental Insurer Breach

Article

Nashville-based HCAHealthcare, the largest for-profit operator of hospitals and clinics in the U.S., said that patient information had been leaked to an online forum.

The breach leaked data for as many as 11 million patients, making it the largest known health care data breach, almost three times the number of patients affected in a 2022 ransomware attack, according to news reports.

The leaked data did not include payment and clinical information, but included patient names and contact details, HCA said.

The data theft appeared to be from an external storage used to automate the formatting of email messages, HCA said, adding that the company had reported the breach to law enforcement.

HCA said it does not expect the incident to materially impact its business, operations or financial results.

Meanwhile, the powerhouse law firm of Morgan & Morgan has filed a proposed class-action lawsuit alleging that another health care giant suffered a data breach that affected more than 9 million patients in several states.

The complaint, filed in federal court in south Florida, charges that Fort Lauderdale-based Managed Care of North America and MCNA Dental, the largest dental insurer in the country, failed to safeguard patients’ personal information, including Social Security numbers and medical treatment histories.

MCNA’s website says the company administers dental insurance for millions of patients covered by Medicaid and children’s health plans, known as CHIP plans.

The LockBit ransomware hacker group claimed responsibility for a March 2023 attack on MCNA, and it leaked some of the stolen data to the dark web. The group demanded $10 million to prevent publication of all the data, according to the lawsuit. MCNA did not pay the ransom and the data was published on April 7, the complaint notes.

The lead plaintiff is Taylor Manning, of Louisiana, but many more plaintiffs could join the suit if the court certifies it as a class action. MCNA has not yet filed an answer or motion to dismiss the suit.