Legacy Health LLC, a healthcare company based in West Sacramento, CA, experienced a ransomware attack discovered on March 20, 2026. The Worldleaks ransomware group was responsible for the attack. Legacy Health LLC issued a formal breach notification letter to affected individuals on March 16, 2026, which was also filed with the Massachusetts Attorney General's office.
The breach exposed personal information including names, Social Security numbers, bank account numbers, and potentially driver's license numbers. The exact number of affected individuals has not been publicly disclosed, and information regarding other affected states beyond California remains unclear. Legacy Health is offering 24 months of credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy, and fully managed identity theft recovery services through IDX.
Additional details about this incident may emerge as investigations continue. Notices to affected individuals may also be delayed.