LHC Group

Summary

LHC Group discovered that an employee may have fallen victim to a phishing attack, while a technology vendor flagged suspicious activity involving its account. The investigation found that stolen credentials were used to access patient files. The breach may have compromised names, dates of birth, Social Security numbers, health information, health insurance information, government identification information, and financial information. Affected individuals were identified and subsequently notified. A national class action law firm is investigating potential legal claims arising from the exposure of this personal data.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

LHC Group discovered the data breach on or about April 7, 2026 after an employee may have fallen victim to a phishing attack and a technology vendor flagged suspicious activity involving an LHC account. The investigation determined that stolen credentials were used to access patient files between April 7 and April 15, 2026. During that window unauthorized individuals could view and potentially copy information stored in those files.

LHC Group began identifying affected individuals in July 2026 and sent breach notifications to patients around September 4, 2026. The exposed data may have included names, dates of birth, Social Security numbers, health information, health insurance information, government identification information, and financial information. Individuals who received the notification were advised that they may face an increased risk of identity theft and fraud.

In response to the incident, the national class action law firm Edelson Lechtzin LLP launched an investigation into data privacy claims arising from the breach and is offering free case evaluations to impacted individuals. The firm is evaluating whether a class action can be pursued to seek legal remedies on behalf of those whose sensitive personal data may have been compromised. LHC Group, which provides home health, hospice care, and facility-based support services nationwide, continues to operate while the investigation proceeds. The firm can be contacted at 411 S. State Street, Suite N-300, Newtown, PA 18940, phone 844-696-7492, email [email protected].

Sources

Sources available to members: 1 source.