Banner Health, a non-profit organization that runs a chain of hospitals, said hackers may have gained unauthorized access to patient, physician and beneficiary data.
Phoenix, Arizona-based Banner said it was notifying 3.7 million patients, health plan members, food and beverage customers, physicians and healthcare providers about the attack, which occurred between June 23 and July 7.
The hackers may have gained unauthorized access to computer systems that process payment card data at food and beverage outlets at some Banner Health locations, the company said on Wednesday.
The company said it had hired a forensics firm and contacted law enforcement agencies.
The attack did not affect all patients, Banner Health said.
Banner Health operates in Alaska, Arizona, California, Colorado, Nebraska, Nevada and Wyoming.