In 2026, LHC Group, a parent organization for home health and hospice providers, disclosed a data security incident. This breach involved unauthorized access to patient files through a third-party vendor's platform, which occurred between April 7 and April 15, 2026. The company discovered the issue on April 7, 2026, after a vishing attack, and subsequently began notifying affected individuals by letter and contacted the FBI.
The compromised data included full names, addresses, dates of birth, and demographic information. It also involved health information such as clinical summaries, treatment plans, diagnosis codes, dates of service, physician/provider details, health insurance policy names and numbers, and Medicare and Medicaid ID numbers. In limited instances, Social Security numbers and financial information were also exposed. The incident has been reported to the Texas Attorney General, indicating at least 16,885 Texas residents were affected. The full scope of the breach and any additional states affected remain unclear.
While there is an active lawsuit investigation and class action inquiry, no confirmed filed class action complaint or Multidistrict Litigation (MDL) status has been identified. Details may emerge as the investigation progresses, and notifications to other potentially affected individuals may be ongoing.