Doctor Alliance data breach: a home health document portal, and the agencies that sent the letters

Date	Event
October 31, 2025	First access to the portal, per Doctor Alliance and its customers
November 7, 2025	A forum post claims 1.24 million files were taken from Doctor Alliance (HIPAA Journal)
November 13, 2025	Date the customer agencies give for when Doctor Alliance learned of the incident
November 16, 2025	Date Doctor Alliance's own letter gives for discovering the access
November 17, 2025	Last day of access in the customers' letters
January 12 to 13, 2026	Community Nurse and Angels Care told by Doctor Alliance
January 15, 2026	Central Home Health Care's report to Massachusetts, the first in the state's list
February 12, 2026	Compassus - Southern Massachusetts first told by Doctor Alliance
March 11 to 12, 2026	Community Nurse letters mailed; reports to New Hampshire and Massachusetts
April 3, 2026	Doctor Alliance's own report to Massachusetts: 8,812 residents
June 26, 2026	Compassus - Southern Massachusetts report: 45 residents

What happened at Doctor Alliance?

Doctor Alliance's own letter is short. It says it discovered on November 16, 2025 that an unauthorized third party had accessed its web application, brought in outside specialists to re-secure its systems, and found that certain files may have been accessed or exfiltrated.

The customers' letters, written from what Doctor Alliance told them, go further. AgeSpan's says the unauthorized party obtained credentials and used an automated script to submit requests that retrieved documents, and that the investigation could not find how the credentials were first obtained. Angels Care Home Health writes that the intruder pulled twelve different types of documents, all holding patient names and care information. Community Nurse's counsel told New Hampshire that Doctor Alliance worked with outside specialists and notified the Federal Bureau of Investigation.

The dates do not line up perfectly. Doctor Alliance gives November 16 as discovery and November 16 as the last day of access; the agencies give November 13 and November 17. Compassus - Southern Massachusetts says the access to its patients' documents ran from November 4 through November 17.

Was the Doctor Alliance data posted or sold?

A claim came before any notice. HIPAA Journal reported on November 17, 2025 that a hacker using the name Kazu posted on a forum around November 7 claiming to have stolen 1.24 million files from Doctor Alliance and asked for a $200,000 ransom. At that point Doctor Alliance had confirmed only that a single client account had been accessed and that the flaw used was fixed the day it was found. None of the letters fetched for this entry says whether the files were published. The forum claim's November 7 date also falls before the November 13 discovery date in the letters, which none of them explains.

Which home health agencies sent Doctor Alliance letters?

Doctor Alliance sent some letters itself, on behalf of customers: the one it filed in Massachusetts names AccentCare as the provider whose patient it is writing to. Other agencies wrote to their own patients. The Massachusetts reports below were fetched for this entry. Each letter names Doctor Alliance, except Elara Caring's, which describes a document-signing vendor and is matched to Doctor Alliance by HIPAA Journal (see its entry).

Organization that reported	Massachusetts report	Filed	MA residents
My485, Inc. d/b/a Doctor Alliance (AccentCare patients)	2026-526	April 3, 2026	8,812
Community Nurse (Fairhaven, MA)	2026-381	March 12, 2026	6,565
Elara Caring	2026-769	May 12, 2026	714
Central Home Health Care, Inc.	2026-67	January 15, 2026	78
Compassus - Southern Massachusetts	2026-1045	June 26, 2026	45
AgeSpan	2026-445	March 23, 2026	8
Total of these six			16,222

The total covers Massachusetts residents only. Angels Care Home Health posted a notice on its website and does not appear in the Massachusetts list. The Elara Caring entry covers that agency's letters.

What did Community Nurse tell patients?

Community Nurse, a home health provider in Fairhaven, Massachusetts, says Doctor Alliance found that certain files were accessed and acquired without authorization between October 31 and November 17, 2025, and that on or about March 2, 2026 it learned the patient's health information was in them. Its counsel told New Hampshire that Doctor Alliance notified Community Nurse on January 12, 2026 and sent a list of affected people, and that about eight New Hampshire residents were among them. Letters went out by first-class mail on March 11, 2026. Massachusetts records 6,565 residents for the report, with medical records marked and Social Security numbers not.

What information was exposed?

Clinical paperwork. Community Nurse lists name, address, date of birth, Medicare number, start of care date, certification period dates, medical record number, provider name and address, type of advance directive, diagnosis and health status, medication list, treatment orders and goals of treatment, and says Social Security numbers were not involved. Doctor Alliance's own letter for AccentCare patients does list Social Security numbers, with medical record number, Medicare number and diagnosis or treatment information. So what a given patient lost depends on the documents their agency kept in the portal.

What has Doctor Alliance changed?

Angels Care lists the fixes Doctor Alliance reported: additional authorization checks on document requests, hardened permission logic, a code review, more authentication and monitoring, and stronger firewall controls, request inspection and application logging. Those are the controls a script cycling through patient IDs and document numbers would have run into.

What should patients do?

Doctor Alliance's letter offers Experian IdentityWorks credit monitoring with $1 million in identity theft insurance, and a help line at (844) 443-1612. Community Nurse's line is (844) 443-1801. Because the documents carry Medicare numbers and treatment details, the letters' own advice applies: read the statements from your providers and your health insurer, and call them about any service you did not receive. The healthcare provider letter guide explains these letters, and the guide to letters from a company you never dealt with covers vendor breaches like this one.

What the documents leave open

• How the intruder got the credentials. The investigation could not tell, according to AgeSpan's letter.
• The total number of patients across all states and agencies. No national count was fetched for this entry.
• Whether the files claimed in the November 7 post were published.
• Which date Doctor Alliance found the access: November 13 in the customers' letters, November 16 in its own.