Skip to content
cisonews.net

Incident · State breach notice (Massachusetts)

AngMar Management Services data breach: a Texas healthcare manager, and patients who never heard of it

Compiled from public records. Updated 2026-11-13. By the cisonews.net Desk.

The AngMar Management Services data breach affected 126,196 people, according to the federal health breach portal, where AngMar Management Services reported a hacking or IT incident as a business associate on September 16, 2026. AngMar Management Services, a Texas company that provides management services and reports to HHS as a business associate, says it found unusual activity on its network on July 20, 2026. An unauthorized actor may have accessed or taken information on or around July 18. The federal health breach list counts 126,196 people; Indiana's attorney general records 110,256 in total, 1,164 of them in Indiana. Letters offer Cyberscout credit monitoring.

Entries like this one, in Wednesday’s docket

Wednesdays

Unsubscribe any time.

Why did I get a letter from AngMar?

AngMar is not a provider that patients visit. The letter says it received the information in the normal course of business, in connection with the management services it provides. It does not name the practices or providers it manages, so the letter may be the first time a reader has seen the name. The guide to breach letters from companies you never dealt with covers letters like this one, and the guide to vendor breach notices shows how such letters are put together.

What happened at AngMar?

AngMar says it secured its systems, opened an investigation and brought in a third-party team of forensic investigators. It then reviewed the affected data to work out whom it concerned.

DateWhat the letter and the regulators' records say
On or around July 18, 2026Information may have been accessed or acquired
July 20, 2026AngMar identifies unusual activity
September 16, 2026Report to HHS (126,196, as a business associate)
September 22, 2026Letter date; Indiana notice (110,256 total; 1,164 in Indiana)
September 23, 2026Logged in Massachusetts (3 residents)

AngMar found the activity two days after the access and dated its letters about nine weeks later. The two counts differ: 126,196 at HHS and 110,256 at Indiana. Neither record explains the gap.

What information was involved?

The letter lists the reader's first and last name with: address, date of birth, Social Security number, patient ID, medical record number, health insurance information, service date, diagnosis or condition information, provider name, prescription information and medical history information. AngMar says there is no evidence that anyone's information has been or will be misused.

What is AngMar offering?

ItemDetail from the letter
ServiceSingle-bureau credit monitoring, credit report and credit score, for the period printed on each letter
ProviderCyberscout, a TransUnion company
Questions1-877-520-9311, Monday to Friday, 8:00 a.m. to 8:00 p.m. Eastern Time, excluding U.S. holidays

The guide to credit monitoring offers sets AngMar Management Services' offer beside other letters.

What Texas's attorney general recorded

Texas's attorney general lists a report from AngMar Management Services, posted on September 25, 2026, with 35,916 Texans affected, a count of Texas residents only. The record lists names, addresses, Social Security numbers, medical information, health insurance information and dates of birth as involved.

What the documents leave open

  • Which providers' patients are among the 126,196.
  • How the unauthorized actor got in.
  • Why the HHS and Indiana totals differ.

With 126,196 people, AngMar Management Services' report is the 44th largest of the 415 open 2026 reports in the ranking of 2026 healthcare breaches reported to HHS.

How this disclosure's timing compares

AngMar Management Services disclosed 64 days after the discovery date its notice gives. Across the 206 other state breach notices on cisonews.net that date discovery to the day, the median gap is 100 days.

Other health care incidents on cisonews.net

All health care incidents

Sources

  1. 2026-09-23 · AAngMar Management Services, notice of data breach filed with the Massachusetts Office of Consumer Affairs and Business Regulation, published September 23, 2026
  2. 2026-11-07 · AU.S. Department of Health and Human Services, Office for Civil Rights, breach portal (breaches affecting 500 or more individuals), published November 7, 2026
  3. 2026-11-07 · AIndiana Attorney General, data breach year-to-date report (2026), published November 7, 2026
  4. 2026-11-07 · AMassachusetts Office of Consumer Affairs and Business Regulation, 2026 Data Breach Notification Report, published November 7, 2026
  5. 2026-11-09 · ATexas Attorney General, data security breach reports, published November 9, 2026

Tier A: the organization itself (including notices it filed with a state attorney general), a regulator or SEC EDGAR. Tier B: established press. Each fact on this page carries its supporting passage in the page source.

Entries like this one, in Wednesday’s docket

Wednesdays

Unsubscribe any time.