El Camino Health, a health system based in Mountain View, California, has notified patients of a data security incident involving unauthorized access to employee Microsoft 365 email and file accounts. Documents copied or downloaded from those accounts contained personal and medical information belonging to some patients.
The health system began mailing notification letters on October 30, 2026 and says its review of the affected documents is still ongoing, so more patients may be notified later.
El Camino Health’s Data Breach Investigation
El Camino Health reports that on September 1, 2026 it identified unusual activity in its Microsoft 365 system. It says it moved to secure the system, brought in third-party forensic experts, and notified law enforcement. The investigation found intermittent unauthorized access to the Microsoft 365 accounts of four employees between August 26, 2026 and September 2, 2026, along with certain documents that were copied or downloaded from those accounts.
After that, El Camino Health began a review of the documents to work out what information they held. That review is described as ongoing. Through it, the organization determined that some of the documents contained information belonging to some of its patients, and it started mailing notification letters on October 30, 2026. The same day, the incident was reported to the California Attorney General, which publishes a sample copy of breach notices sent to more than 500 California residents.
The health system states that its electronic health record system was not involved in the incident. That distinction matters, because the exposure here comes from documents kept in employee email and file accounts rather than from the main patient chart system. Even so, documents that staff keep in those accounts, such as reports, spreadsheets, correspondence, and billing records, can carry a surprising amount of sensitive detail about patients.
El Camino Health has not published a total number of people affected, and it has not said how the four employee accounts were accessed. It has also not said whether any of the documents were used or posted anywhere. Because the document review has not finished, the number of people who will end up receiving a letter could grow, and anyone who has been treated at El Camino Health should watch for mail from the organization.
Email account compromises are among the most common ways health organizations lose patient data. Attackers who get into a single mailbox through a stolen password or a convincing phishing message can often search years of messages and attachments in a short time. Staff in healthcare roles routinely exchange documents containing patient identifiers, which is why a small number of compromised accounts can still touch a large number of records.
Notification timing also deserves a note. The unauthorized access ended on September 2, 2026, and letters began going out on October 30, 2026. In between, the organization had to examine the copied documents to figure out which individuals were named in them and what information each file held. State breach notification laws and the federal health privacy rules generally require notice without unreasonable delay once an organization determines that personal information was involved, and they expect the organization to complete that review diligently.
The letter El Camino Health is sending explains that the information involved varies from person to person. Recipients are encouraged to enroll in complimentary identity monitoring through Experian, which the organization is paying for, and to review statements from their providers and health insurers for services they did not receive.
Health information is among the most sensitive kinds of personal data. A Social Security number or date of birth can support new-account fraud, while diagnosis, treatment, and prescription details can support medical identity theft and highly targeted scams. Unlike a password, none of that information can be changed after it has been exposed, so the risk can last for years rather than months.
People who receive a notice should read it closely and keep it. It identifies the specific types of information tied to the individual, and it is the main proof that a person was among those affected by this incident, which can matter if legal options are later considered.
When Did This Breach Occur?
El Camino Health says it identified unusual activity in its Microsoft 365 system on September 1, 2026. Its investigation found that the unauthorized access to four employee accounts was intermittent and took place between August 26, 2026 and September 2, 2026.
Notification letters began going out on October 30, 2026, and the incident was reported to the California Attorney General on the same date. Because the review of the affected documents is ongoing, additional patients may be notified after that date.
What Information Was Breached?
According to the notice, the information involved varies by individual. Based on the review so far, the documents may contain a patient’s name along with some or all of the following: contact information, demographic information, Social Security number, driver’s license number, date of birth, medical record number, patient account number, diagnosis information, treatment information, prescription information, provider names, dates of service, and health insurance information.
For some patients, financial account and routing numbers may also have been involved. Not every person had every type of information exposed, and the letter each person receives is the best guide to what applies to them.
What You Can Do
If you received a notice from El Camino Health, or you were treated there and are concerned, consider the following steps.
- Enroll in the complimentary 12 months of Experian IdentityWorks identity monitoring offered in the letter, using the activation code and instructions it provides.
- Review the explanation of benefits statements from your health insurer and the statements from your providers, and contact the issuer right away if you see services you did not receive.
- Watch your financial account statements for suspicious activity and report anything unusual to your bank or card issuer immediately.
- Request your free credit reports from Equifax, Experian, and TransUnion at annualcreditreport.com and look for accounts you did not open.
- Consider placing a free fraud alert or security freeze with each of the three credit bureaus, especially if your Social Security number was involved.
- Be cautious with unexpected calls, texts, or emails that mention El Camino Health, a bill, or an insurance claim, even if the sender knows personal details about you.
- Keep your notice and records of any suspicious activity, fraud, or time and money spent dealing with the incident.
File a Data Breach Lawsuit Against El Camino Health
People whose personal and medical information is exposed in a security incident may have legal options if the organization failed to use reasonable safeguards to protect it. Whether a claim exists depends on the facts, including what was exposed, how the access happened, and how the organization responded.
If you received a notice from El Camino Health, or you believe your information was involved, you can speak with a lawyer about whether you may be able to join a class action lawsuit to seek compensation for the exposure of your information, the time you spent responding, and any losses you suffered.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
