LHC Group is alerting patients to a data breach that involved access to personal data and health information.
 
The data breach was linked to a third-party technology vendor LHC used to support referral management, care coordination and clinical workflow functions, according to a patient notice.  
 
“On April 7, 2026, LHC became aware that an employee may have been the victim of a vishing (voice phishing) attack,” the notice stated. “Subsequently, LHC’s vendor reported suspicious activity in their platform associated with an LHC user account. LHC immediately launched an investigation, took steps to secure its systems, worked with the vendor, enlisted the assistance of third-party forensic experts and notified the FBI.”
 
LHC’s investigation determined that a threat actor stole credentials to access a large volume of files from the vendor’s platform that contained patient protected health information (PHI), according to the pateint notice. The unauthorized access occurred from April 7, 2026, through April 15, 2026. LHC began confirming identities of impacted individuals on July 9, 2026.
 
Documents accessed by the threat actor may have included:
  • Full names, addresses, dates of birth, and demographics
  • Social Security numbers (in limited instances)
  • Health information such as clinical summaries, treatment plans, diagnosis codes, dates of service, and physician or provider information
  • Health insurance information such as policy names, numbers, and plan information
  • Government identification information such as Medicare and Medicaid ID numbers
  • Financial information (in limited instances)
LHC said it took steps to strengthen its security following the incident and minimize the risk of any similar incident in the future. Those steps included:
  • Disabling the compromised account
  • Conducting a review to check for additional areas of improvement
  • Enhancing authentication requirements and monitoring
  • Strengthening additional security controls
According to a report by The HIPAA Journal, more than 28,000 individuals have been affected. They note the total number could be much higher, since some states involved don’t publicly disclose how many state residents were affected.
 
For more information: