Advocate Aurora Health, which operates 27 hospitals, said in a statement Thursday that the breach may have exposed information including patients’ medical provider, type of appointment or medical procedure, dates and locations of scheduled appointments and IP address.