Healthcare Services Group, Inc. (HSGI) experienced a data breach that began on September 27, 2024, and continued until October 3, 2024. The company discovered the unauthorized access on October 7, 2024, and confirmed sensitive data was stolen on June 3, 2025. HSGI filed a FORM 8-K with the SEC on October 16, 2024, and notified the Maine Attorney General’s Office and the Texas Attorney General.
The breach impacted 624,496 individuals across 48 U.S. states. The compromised data types include names, Social Security numbers (SSN), driver’s license numbers, state ID numbers, financial account information, full access credentials, dates of birth, health insurance records, medical/PHI information, employee payroll/tax records, and stockholder data. HSGI states there is no evidence of fraud or identity theft resulting from the breach, but urges vigilance. Notification letters were mailed to affected individuals starting August 25, 2025. HSGI offered 12 months of free Experian credit monitoring and identity restoration services.
This incident is a vendor breach, as HSGI provides laundry, dining, and environmental support to healthcare facilities and acts as a business associate under HIPAA. Despite initial allegations, no ransomware group has officially claimed responsibility for this incident. Details regarding the full scope and impact of the breach may continue to emerge.