Hoag Hospital Data Breach

Hoag Memorial Hospital Presbyterian says hackers may have accessed files containing patient information. Notice letters went out on November 4, 2026.

Hoag Memorial Hospital Presbyterian (“Hoag Hospital”) is the Newport Beach nonprofit health system that runs acute care hospitals in Newport Beach and Irvine, California. According to its Notice of Data Breach letter, Hoag Hospital became aware of suspicious activity in its network on October 8, 2026.

Hoag Hospital says it started an investigation and hired independent forensic experts. The investigation found that certain files may have been accessed without authorization. A separate review of those files finished on October 25, 2026. That review found that some personal and/or protected health information may have been in the affected files.

Hoag Hospital dated its notice letters November 4, 2026, and reported the breach to the California Attorney General the same day.

How Quickly Hoag Hospital Sent Notice

Hoag Hospital sent notice about four weeks after it first spotted the suspicious activity, and about 10 days after its file review ended. That is faster than many healthcare breaches.

A fast notice also means some facts are still unclear. Hoag Hospital has not publicly said how many people were affected or exactly which types of information were in the files.

Hoag Hospital filed with the California Attorney General. California requires that filing when a breach affects more than 500 California residents, so at least that many Californians are likely involved. The full total has not been disclosed.

What Information Was Exposed in the Hoag Breach?

The sample letter Hoag Hospital filed with the California Attorney General says the information involved may include each person’s name along with other data elements. The specific elements are left as a blank field in the sample, so they vary by person and are not public yet.

Hoag Hospital’s letter says the files may have held personal and/or protected health information. Each person’s own letter should list the specific information involved for them.

Affected individuals should read their letter closely to see which details apply to them.

What Is Hoag Hospital Offering Affected Patients?

Hoag Hospital is offering free credit monitoring and identity protection through IDX. According to the letter, the services include credit and dark web monitoring, an insurance reimbursement policy, and identity theft recovery help. The length of the service (12 or 24 months) depends on the person’s letter.

• Enrollment deadline: February 4, 2027
• IDX phone: 1-877-201-3399, Monday through Friday, 6 a.m. to 6 p.m. Pacific Time
• Enrollment code: printed on each person’s letter

Credit monitoring requires the person to be over 18, have established U.S. credit, a Social Security number and a U.S. address on file.

Why a Hospital Data Breach Puts Patients at Risk

Hospital files often hold more than names and addresses. They can include medical record numbers, insurance details and treatment history. Criminals can use that kind of information for medical identity theft and insurance fraud.

Affected individuals can take these steps:

• Enroll in the IDX services before February 4, 2027
• Review explanation of benefits statements for care you did not receive
• Check credit reports at annualcreditreport.com
• Consider a free credit freeze with Equifax, Experian and TransUnion
• Be wary of calls or emails that mention the Hoag breach

What Legal Options Do Hoag Patients Have?

Hospitals have a legal duty to protect the personal and health information patients trust them with. When that duty is not met, affected patients may have legal rights and remedies worth discussing with an attorney.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review. 

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Much of the information involved in this incident may also qualify as Protected Health Information (PHI). PHI includes medical or healthcare-related data protected under federal and state privacy laws. When PHI is compromised, it can be misused for medical identity theft or insurance fraud.

Residents of California may be entitled to additional protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights regarding the collection, use, and safeguarding of personal information.

Frequently Asked Questions

How many people were affected by the Hoag Hospital data breach?

Hoag Hospital has not said. Its California Attorney General filing suggests more than 500 California residents, but that is a floor, not a total.

What information was exposed?

Your name and other personal and/or protected health information may have been in the files. The exact items vary by person, so check your letter.

When did the Hoag breach happen?

Hoag Hospital noticed suspicious activity on October 8, 2026. Its file review ended October 25, 2026, and letters are dated November 4, 2026.

What should I do if I received a letter?

Take these steps:

• Enroll in IDX before February 4, 2027 (1-877-201-3399)
• Watch your insurance statements and medical bills
• Consider a credit freeze
• Keep your letter for your records

Why is medical information so valuable to criminals?

Unlike a credit card, you cannot cancel your medical history. Criminals can use health and insurance details to bill for care you never received, fill prescriptions or file false insurance claims. These problems can show up months later on a bill or an explanation of benefits.

Could scammers use this breach to contact me?

Yes, that is a common follow-up risk. Scammers sometimes send emails, texts or calls that mention a real breach by name to seem trustworthy. Do not click links or share codes or passwords with anyone who contacts you about the breach. Use the phone number printed on your official letter instead.

Do I have a legal claim?

Possibly. Hospitals that collect patient information have a duty to protect it and to tell people promptly when it is exposed. If that duty was not met, you may have legal rights. Contact Emery | Reddy at 916.995.5968 or visit www.emeryreddy.com for a Free Case Review. No Fee Unless We Recover.