LHC Group data breach: vishing call led to theft of patient files from a vendor platform, April 2026

Date	Event
April 7, 2026	LHC learns an employee may have been the victim of a vishing call; unauthorized access begins
April 15, 2026	Last day of unauthorized access
July 9, 2026	LHC begins confirming the identities of the people affected
September 4, 2026	Report to Massachusetts (2026-1506): 4,812 residents
December 4, 2026	Last day to enroll in the IDX monitoring

What happened in the LHC Group breach?

The attack went through a vendor, by way of a phone call. LHC says it uses a third-party technology vendor for referral management, care coordination and clinical workflow in its home health services. On April 7, 2026, LHC became aware that an employee may have been the victim of a vishing attack, and the vendor then reported suspicious activity on its platform tied to an LHC user account. LHC says it investigated, secured its systems, worked with the vendor, brought in third-party forensic experts and notified the FBI.

The notice names neither the vendor nor the employee, and it does not say what the caller asked for. The file name of the PDF on LHC's site calls it a "stolen session" notice; the text itself says the threat actor stole credentials.

What information was exposed?

More than in most breach letters, because the files were clinical. The notice lists names, addresses, dates of birth and demographics; Social Security numbers in limited instances; clinical summaries, treatment plans, diagnosis codes, dates of service and provider details; health insurance policy names, numbers and plan information; Medicare and Medicaid ID numbers; and, in limited instances, financial information. Not every element was involved for every person.

Record	Residents	Data marked
Massachusetts OCABR, report 2026-1506	4,812	Social Security numbers, medical records

What is LHC offering, and what should patients do?

Two years of credit monitoring and identity protection through IDX, paid for by LHC. The enrollment deadline is December 4, 2026, using the code in the letter at app.idx.us. The call center is 1-866-200-0905, Monday to Friday, 8 a.m. to 8 p.m. Central Time.

Because the files held health and insurance details, the notice asks people to check explanation of benefits statements as well as bank and credit statements, and to contact their plan about any service they did not receive. LHC says it disabled the compromised account and strengthened authentication and monitoring. The social engineering guide compares other incidents where attackers talked their way in, and the vendor and cloud-tenant guide covers breaches that ran through a vendor's platform.

Why did notice take until September?

LHC says that after extensive review and data analysis it began confirming the identities of the people affected on July 9, 2026. The Massachusetts report followed on September 4, 150 days after the access began. The notice delay guide shows the times other health care organizations took from discovery to notice.

How many people were affected?

The notice gives no total. Massachusetts counts 4,812 of its residents. No other state list fetched for this entry gives a count, and the federal health breach list could not be read when this entry was written.

What the documents leave open

• The name of the vendor and how the stolen credentials worked on its platform.
• The total number of patients notified.
• Whether anyone has claimed the files or asked for payment.