Hospital Caribbean Medical Center Data Breach (92 Thousand People Affected)

The Hospital Caribbean Medical Center data breach affected 92,000 people in a cyberattack publicly disclosed in February 2026 and involving protected health information.

Hospital Caribbean Medical Center provides emergency and inpatient care in Fajardo, Puerto Rico. The hospital said the incident affected part of its information systems and that its network returned to normal operation after containment.

What Happened in the Hospital Caribbean Medical Center Incident?

According to the hospital's official February 8, 2026 announcement, institutional monitoring systems detected suspicious activity. The organization activated its internal security and response protocols and implemented containment and isolation measures with outside cybersecurity experts.

The hospital said it notified the relevant authorities and continued a technical review to establish the incident's scope. Public official documents do not identify the date of the attack, the initial access method, or the responsible party.

What Information Was Affected?

The event appears in the HHS HIPAA breach portal, confirming a healthcare-sector report involving protected health information. The hospital's announcement did not publish a detailed list of fields such as names, dates of birth, Social Security numbers, financial information, or specific medical data.

It should therefore not be assumed that a particular data type applied to a particular person. Detailed field lists on third-party pages are not included in the confirmed scope unless supported by an official hospital or regulatory statement.

How Many People Were Affected?

The official U.S. Department of Health and Human Services breach portal reports 92,000 affected individuals. Its April 6, 2026 entry classifies the event as a hacking or IT incident involving a network server.

What Should Affected People Do?

Notice recipients should rely on the data scope in their own letters and review benefit statements, medical bills, and insurance claims for unfamiliar services, providers, or charges.

Unexpected email, telephone, or payment requests using the hospital's name should be verified through an independent channel such as its official website. Because specific identity or financial fields have not been publicly disclosed, additional measures should be based on the person's own notice.