2026 LHC Group — Apr 7–15 vishing → vendor platform PHI access; ≥21,697 in TX+MA filings
Data compromised
Names, addresses, DOBs/demographics; limited SSNs; clinical summaries, treatment plans, diagnosis codes, dates of service, provider info; health insurance; Medicare/Medicaid IDs; limited financial info
Technical writeup
Verified LHC Group patient notices — substitute notice ~Sep 3–4, 2026. Vishing against an LHC employee Apr 7; vendor reported suspicious platform activity; unauthorized access to PHI files Apr 7–15; identities confirmed from Jul 9. Distinct from prior Doctor Alliance–related LHC catalog row. State reporting cited includes ~16,885 Texas and ~4,812 Massachusetts residents (floor 21,697); national OCR census not located at indexing. recordsAffected 21697 as attested state-filing floor; companyConfirmed true.
Root cause
Employee vishing (voice phishing) ~Apr 7, 2026; stolen credentials used against a third-party referral/care-coordination vendor platform Apr 7–15