Proxycare data breach: files removed in August 2025, health information found in January

What happened at Proxycare?

Proxycare says it contained the threat and investigated with outside cybersecurity professionals. A forensic investigation and a manual review of the files followed, and the review ended on January 29, 2026.

Date	What the letter and the regulators' records say
On or about August 22, 2025	Proxycare learns systems were affected
January 29, 2026	Review finds personal health information in the files
March 27, 2026	Report to HHS (45,196); logged in Massachusetts (125 residents)

The report to HHS came 57 days after the review finished, and seven months after Proxycare learned of the incident.

What information was involved?

Proxycare's sample letter names the reader and leaves the other data items blank. For the 125 Massachusetts residents in Proxycare's notice, the state's record marks Social Security numbers as breached, and not medical records. Proxycare says it knows of no identity fraud or identity theft resulting directly from the incident.

What is Proxycare offering?

Item	Detail from the letter
Service	Identity theft protection, including $1,000,000 identity theft insurance and Social Security number monitoring
Provider	Epiq Privacy Solutions ID
Enrollment	www.privacysolutionsid.com, with the activation code and deadline printed on the letter

The guide to credit monitoring offers sets Proxycare's offer beside other letters, and the guide to healthcare provider breach notices compares other providers' letters.

What is Proxycare?

HIPAA Journal describes ProxyCare as a Sunrise, Florida provider of personalized pharmacy services. The filings with regulators use the name Proxycare, Inc. For patients, that means the letter may come from a pharmacy service rather than a doctor's office or hospital.

What information was involved in the Proxycare breach?

HIPAA Journal, reporting on the notice, lists four items: names, dates of birth, Social Security numbers and driver's license numbers. That fits the Massachusetts record, which marks Social Security numbers as breached and medical records as not. It reports that letters were mailed on March 23, 2026, and that people whose Social Security numbers were involved were offered credit monitoring and identity theft protection.

Date	What happened	Source
August 22, 2025	Proxycare learns systems were affected	Letter; HIPAA Journal
January 29, 2026	Review finds which files and people were involved	Letter; HIPAA Journal
March 23, 2026	Letters mailed	HIPAA Journal
March 27, 2026	Report to HHS (45,196); logged in Massachusetts (125)	HHS; Massachusetts

From the day Proxycare learned of the incident to the letters took 213 days. The notice-delay guide shows how that compares with other notices.

How many people were affected by the Proxycare breach?

45,196 people, the number Proxycare gave the federal health privacy office.

Record	What it counts	Number
HHS Office for Civil Rights	People affected	45,196
Massachusetts consumer affairs office	Massachusetts residents	125

Was my information in the Proxycare data breach?

If you got a letter from Proxycare in late March 2026, your information was in the files the review found. The letter's enrollment code is for Epiq's identity protection, described above.

What the documents leave open

• What kind of incident it was and how it began; neither the letter nor the news report names a group.
• Whether the removed files have been published.

With 45,196 people, Proxycare's report is the 81st largest of the 415 open 2026 reports in the ranking of 2026 healthcare breaches reported to HHS.