Hoag Hospital says files in its network may have been accessed, with patient health information inside

What happened in the Hoag Hospital data breach?

Hoag says it started an investigation as soon as it saw the activity and brought in independent forensic experts. That investigation found that certain files may have been accessed without authorization, and the hospital then hired an independent team to review those files one by one for personal information.

California's record gives October 8, 2026 as the date of the breach, the same day Hoag says it noticed the activity. The letter does not say when the intruder first got in, so that date may be earlier.

Date	What the letter and California's record say
October 8, 2026	Hoag becomes aware of suspicious activity in its network; date of breach on California's record
October 25, 2026	The file review finds patient information in the potentially affected data
November 4, 2026	Letter date; notice filed with California's attorney general
February 4, 2027	Last day to enroll in the IDX services

That is 27 days from discovery to the letter, and 10 days from the end of the file review to the letter. This site's study of notice delays shows how those gaps compare with other notices.

What information was involved?

The letter filed with California does not list the information: where each patient's letter would name the data, the filed copy carries a blank field after "your name along with your". Each recipient's own letter is the only place that says which details of theirs were in the files.

The filing holds two versions of the letter. One says the incident may have involved "personal and/or protected health information" and offers credit monitoring; the other says only "protected health information" and offers dark web monitoring without credit monitoring. The letter does not say how many people are in each group, or which details put a patient in one group or the other.

What is Hoag offering people who got a letter?

Both versions offer free enrollment in IDX identity protection services. The first version includes credit and CyberScan dark web monitoring, a $1,000,000 insurance reimbursement policy and fully managed identity theft recovery services; the length of the monitoring is 12 or 24 months, depending on the recipient's letter. The second version offers the same package without the credit monitoring.

To get credit monitoring, a recipient must be over 18, have established credit in the United States, have a Social Security number in their name and have a U.S. residential address on their credit file.

Item	Detail from the letter
Provider	IDX
Enrollment	app.idx.us/account-creation/protect, with the code printed on the letter
Phone	1-877-201-3399, Monday to Friday, 6 AM to 6 PM Pacific Time, excluding major U.S. holidays
Deadline	February 4, 2027

The phone line is staffed by IDX, and the letter says its representatives can answer questions about the incident. Hoag also says it has added security measures to its digital environment to help prevent a similar incident.

What should a patient who got the letter do?

The letter's own steps are to enroll in IDX before February 4, 2027, review account statements and credit reports, report suspected identity theft to law enforcement, the state attorney general or the Federal Trade Commission, and consider a free fraud alert or security freeze with Equifax, Experian and TransUnion. A security freeze has to be placed separately with each of the three bureaus. This site's guide to credit monitoring offers in breach letters compares IDX's package with what other notices offer, and the guide to healthcare provider notices sets Hoag's letter beside other clinics' and hospitals'.

How many people were affected?

The letter and California's record give no count. California's law requires a sample copy of a notice sent to more than 500 California residents to go to the attorney general, so the filing points to more than 500 Californians receiving a letter. How to read a California attorney general breach notice explains what the record does and does not show.

What the notice leaves open

The letter does not say how the intruder got into the network, whether the attack involved ransomware, whether files were taken rather than only accessed, or how many patients are affected. It does not say whether any of the information has been misused.