A threat actor claims to have breached Medina Regional Hospital in Hondo, Texas, and to be releasing its full database, including patient identities, Social Security numbers, clinical records and billing data. The November 11, 2026 allegation has not been independently corroborated.
The claim names the hospital’s public website, medinahealthcare.net, which belongs to Medina Healthcare System. That system encompasses the hospital, medical clinics in Hondo, Devine and Castroville, and several specialty clinics, and is owned and managed by the Medina County Hospital District. The same account recently alleged a database leak at Spencer’s. It registered in September 2026 and has limited posting history. Medina Regional Hospital had not issued any public statement at time of publication.
Record totals are not a patient count
The actor lists about 136,527 patient identity records and 137,254 patient accounts, along with 1,227,157 guarantor accounts. Those figures come from the actor and are not verified. Many of the other totals in the claim describe table rows, such as billing, scheduling or clinical entries, and must not be read as a count of affected people. The roughly 136,527 patient identities are the closest figure the claim offers to a people count.
Within the alleged identity records, the actor claims 101,871 entries include a date of birth, 7,863 include a driver’s license number and 77,426 include a full 9-digit Social Security number. It also claims contact details inside those records, including 23,347 email addresses, 8,694 mobile numbers, 115,214 home phone numbers, 9,890 work phone numbers and 110,545 home addresses. The actor posted a purported sample of patient-record fields. BreachNews is not reproducing that material or any personal information from it.
Clinical, billing and staff data also claimed
Beyond identity records, the actor claims a wide range of patient accounting and clinical tables, including:
- Patient accounting: 143,311 insurance policy rows, 2,170,171 admission and discharge aggregate rows, 505,140 receivables rows, 465,944 payment and adjustment rows, 35,909 bad debt rows, 212,407 scheduling rows, 296,036 patient flow check-ins and 3,448,254 discharge instruction rows
- Clinical records: 5,421,982 patient alert rows, 351,925 chart note rows, 1,036,534 clinical note rows and 7,495,991 vital sign rows
- Documents: 34,424 patient document files and 21,569 staff or HR document files
The claim also covers internal systems and communications. The actor alleges 241,097 original email message files from 20 mailboxes, 1,058 directory user accounts, 100 voicemail PINs stored in plaintext, 111 OAuth consumer and token secrets, and 1,972 application source and configuration files.
None of these counts has been independently verified. The actor did not describe how access was supposedly obtained, when the intrusion allegedly occurred or whether a ransom was demanded. The post presents the material as a free release of a full database.
Why the alleged mix of data would be serious
If genuine, a dataset that combines Social Security numbers, dates of birth, driver’s license numbers and home addresses would be highly useful for identity theft and tax or benefits fraud. Clinical notes, chart notes, alerts, vital signs, insurance policy information and discharge instructions would add protected health information to that identity package, which can support targeted medical or insurance scams and is among the most sensitive data a hospital holds.
Staff and access items would raise a separate set of risks. Directory accounts, plaintext voicemail PINs and OAuth secrets could help an attacker stay inside systems or impersonate staff, while source and configuration files could expose how internal applications are set up. Emails from hospital mailboxes could contain patient correspondence or other confidential traffic.
People who have been patients at Medina Regional Hospital or its clinics can watch for phishing and unexpected calls that reference real appointments, bills or medical details. Social Security numbers and driver’s license numbers, if exposed, also warrant caution with tax, credit or government-benefits messages. Those steps are precautions. They do not confirm that any particular person’s data was taken.
No public confirmation so far
The hospital’s public website and news pages did not contain a notice about a data incident at time of publication. No listing matching this claim was identified in the U.S. Department of Health and Human Services Office for Civil Rights breach report in the sources reviewed. Readers can track reported U.S. healthcare incidents, and check whether a Medina filing appears later, in the BreachNews HIPAA breach tracker.
The alleged access method, timing, authenticity and scope remain unresolved. Because the account behind the claim is relatively new and has a limited history, the figures should be treated with particular caution until Medina Healthcare System, regulators or another independent source confirm whether an incident occurred.
