BAYADA Home Health Care data breach: data copied over 13 days, letters four months later

What happened at BAYADA?

BAYADA says it first became aware of a cybersecurity event on March 2, 2026, started its incident response and brought in outside forensic investigators. After the investigation, data review specialists went through the affected data, and BAYADA finished identifying who needed notice on July 1, 2026. It says it reported the event to federal law enforcement and to the U.S. Department of Health and Human Services.

Date	What the letter and the regulators' records say
February 18, 2026	Copying of data begins; Indiana gives this as the breach date
March 2, 2026	BAYADA becomes aware; copying ends; California gives this as the breach date
May 4, 2026	Report submitted to HHS with 500 individuals
July 1, 2026	Review of the data finished
July 17, 2026	Letter date; recorded by California, Indiana and Massachusetts
July 21, 2026	Posted on the Texas attorney general's list

The letters went out 137 days after BAYADA became aware of the event. HHS's figure of 500 people was filed in May, two months before the review ended.

What information was involved?

The filed letter leaves the list of data as a blank field filled in for each reader, alongside the name. The state records give the categories:

Regulator	Information it records
Texas attorney general	Name; Social Security number; driver's license number; financial information; medical information; health insurance information
Massachusetts consumer affairs office	Social Security numbers, medical records, financial accounts and driver's licenses marked as breached; payment cards not

BAYADA says it has no indication of identity theft or fraud related to the event.

How many people were affected?

Regulator	What it counts	Number
Indiana attorney general	Total affected	550,164
Massachusetts consumer affairs office	Massachusetts residents	14,125
Texas attorney general	Texans	1,270
Indiana attorney general	Indiana residents	780
HHS Office for Civil Rights	Individuals affected (May filing)	500

Massachusetts also logged a BAYADA report on January 30, 2026, covering 1,665 residents. That was before this breach began, so it concerns a different event.

What is BAYADA offering people who got a letter?

Single-bureau credit monitoring, a credit report and a credit score from Cyberscout, a TransUnion company, with fraud assistance, at no charge. The length is a blank field in the filed copy.

Item	Detail from the letter
Provider	Cyberscout (TransUnion)
Enrollment	bfs.cyberscout.com/activate, with the code in the letter
Phone	1-833-851-9449, Monday to Friday, 8:00 a.m. to 8:00 p.m. ET, excluding U.S. holidays
Postal address	BAYADA Home Health Care, Inc., 4300 Haddonfield Road, Pennsauken, NJ 08109, ATTN: Privacy Officer

The letter also asks readers to check account statements and explanation-of-benefits forms. The guide to healthcare provider breach notices compares other providers' letters, and the guide to notice delays puts the 137 days in context.

What the documents leave open

• How the actor got in, and which systems held the copied data.
• Why HHS's count was 500 when Indiana's total is 550,164, and whether HHS has received a revised figure.
• The length of the monitoring offer.