Telecare Health data breach: patients told nine months after January intrusion

What happened at Telecare?

Telecare says it found unusual activity in its digital environment around January 25, 2026, and investigated with outside cybersecurity experts. The electronic review of the affected data finished on September 4, 2026, and found each recipient's information in it. The letter does not say how the intruder got in, what systems were involved or whether data was copied.

Date	What happened	Source
On or around January 25, 2026	Telecare finds unusual activity	Notice letter, California AG record
September 4, 2026	Review of the affected data finished	Notice letter
October 22, 2026	Letter date	Notice letter
January 22, 2027	Last day to enrol with IDX	Notice letter

California's record gives January 25, 2026 as the date of the breach. That is almost nine months from discovery to the letter, and more than seven of them went on the review. The guide to how long organizations take to notify compares that gap with other letters in this log.

Why did I get a letter from Telecare?

Telecare is not always the organization a patient dealt with directly. It wrote because it provided health services on someone else's behalf, and each letter names that organization where the sample shows a blank field. The file name of the copy filed in California, "Notice Letter - Patients - All Other Entities", suggests other versions exist for particular providers, but only this one is on the record. The guide to letters from a company you never dealt with explains how this kind of service-provider notice works.

What patient information was involved?

The filed copy does not list it. It says the information may include the patient's name, followed by an empty field where each person's own list belongs. The subject line is a blank field as well, so even the letter's title varies by recipient. Telecare says it knows of no attempted or actual misuse of the information. The guide to healthcare provider breach notices compares what other clinics and medical groups have told patients.

What is Telecare offering?

IDX identity protection at no charge: credit monitoring, CyberScan monitoring and managed identity theft recovery. The length is left open in the sample, which reads "[12 months/24 months]", so each letter states its own term. Enrolment is at response.idx.us/telecare with the code in the letter, and it closes on January 22, 2027. The guide to credit-monitoring offers compares terms across letters.

Was my information in the Telecare data breach?

Telecare's call center can answer that. It takes calls on 1-866-200-0886, Monday to Friday, 9:00 a.m. to 9:00 p.m. Eastern Time, except holidays. A letter dated October 22, 2026 from Telecare means its review found your information in the affected data.

How many Washingtonians were affected by the Telecare breach?

Washington's attorney general lists a notice from Telecare Health reported on November 9, 2026, with 19,922 Washingtonians affected. Its record names names, Social Security numbers, driver's license or state ID numbers, health insurance policy or ID numbers and medical information as the information compromised. The Washington ranking compares 2026's notices. The figure counts Washington residents only.

What the notice leaves open

• How many patients were affected. Even the Rhode Island count in the sample is a placeholder.
• Which providers Telecare served, and so whose patients were involved.
• How the intruder got in and whether data was taken.
• Which data elements each patient lost, and for how long IDX covers them.

The guide to reading a California notice explains why filed samples carry fields like these.