Operation PAR, Boley Centers and Eleos data breach: patients and staff of three Florida providers

Why did I get this letter?

The letter says readers may have been a patient or an employee at one or more of the three organizations. It names them as Operation PAR, Inc., Boley Centers, Inc. and PEMHS dba Eleos, and gives a Pinellas Park, Florida address. Operation PAR filed its HHS report as a business associate rather than as a provider, and marked a business associate as present.

What happened?

The three organizations say they secured the network, opened an investigation and worked with outside cybersecurity professionals. Their review of the data found on June 10, 2026, a year to the day after detection, that the files may have held the reader's personal information.

Date	What the letter and the regulators' records say
June 6 to 10, 2025	Files may have been accessed or removed
On or about June 10, 2025	Unauthorized access detected
June 10, 2026	Review finds the reader's information in the files
June 25, 2026	Report to HHS (145,714, as a business associate); logged in Massachusetts (375 residents)

What information was involved?

Each letter lists the reader's first and last name and their own items; the sample leaves the rest blank. For the 375 Massachusetts residents in Operation PAR's notice, the state's record marks Social Security numbers, medical records and driver's licenses as breached. The organizations say they have no evidence that anyone's information has been used for financial fraud or identity theft. They say they have strengthened their network and made security improvements that outside experts recommended.

What data was taken in the Operation PAR breach?

The sample letter leaves the list blank, but The HIPAA Journal, reporting on July 28, 2026, listed what the incident exposed: first and last names, dates of birth, Social Security numbers, driver's license numbers, financial account information, medical information and health insurance information. It described Operation PAR as a Pinellas Park, Florida addiction treatment and mental health provider and the 145,714 as current and former clients.

Was Operation PAR's data posted online?

The letter does not say. The HIPAA Journal reported that the attack appears to have been the work of the WorldLeaks group, which added Operation PAR to its dark web leak site in July 2025 and then released the data; Operation PAR's letters do not name any group. The publication also reported that the group went on to leak the stolen data.

Date	What happened	Source
June 10, 2025	Suspicious activity found on the network	Letter; The HIPAA Journal
July 2025	Operation PAR listed on a leak site, per The HIPAA Journal	The HIPAA Journal
June 10, 2026	Review confirms personal and health information in the files	Letter
June 25, 2026	Letters start; HHS report (145,714)	The HIPAA Journal; HHS

What is offered?

Item	Detail from the letter
Service	Epiq credit monitoring, with the coverage length and enrollment deadline printed on each letter
Questions	866-659-7103, 8:00 a.m. to 8:00 p.m. Central Time, Monday to Friday, excluding holidays, for 90 days from the letter date

The guide to credit monitoring offers sets Operation PAR's offer beside other letters.

What the documents leave open

• How many of the 145,714 are patients and how many are employees.
• Which of the three organizations each person's data came from.
• How the intruder got in.

With 145,714 people, Operation PAR's report is the 38th largest of the 415 open 2026 reports in the ranking of 2026 healthcare breaches reported to HHS.