LHC Group Discloses Data Breach Affecting Nearly 17,000 Texas Residents LHC Group Inc., a national provider of in-home healthcare services, recently reported a data breach stemming from a third-party technology vendor’s platform. The incident, disclosed in a filing with the Texas Attorney General on September 4, 2026, impacted 16,885 Texas residents, with sensitive personal and health information compromised. The breach originated from a vishing (voice phishing) attack on April 7, 2026, when an employee of the unnamed vendor was tricked into divulging login credentials. Shortly after, the vendor detected suspicious activity linked to an LHC Group user account. A threat actor exploited the stolen credentials to access files containing protected health information (PHI) and personally identifiable information (PII) between April 7 and April 15, 2026. Exposed data included full names, addresses, dates of birth, Social Security numbers (in limited cases), financial details, clinical summaries, treatment plans, diagnosis codes, health insurance information, and government IDs such as Medicare and Medicaid numbers. LHC Group launched an investigation, confirming affected individuals by July 9, 2026. In response, the company is offering two years of complimentary credit monitoring and identity protection services through IDX, with enrollment available until December 4, 2026. A dedicated call center has also been established for inquiries.

LHC Group Data Breach Exposes Sensitive Patient Information in 2026 Incident A cybersecurity breach at LHC Group, a nationwide healthcare provider specializing in home health, hospice, and facility-based care, compromised sensitive patient data earlier this year. The incident, discovered on April 7, 2026, stemmed from a phishing attack targeting an employee, alongside suspicious activity flagged by a technology vendor. Investigators confirmed that stolen credentials were used to access patient files between April 7 and April 15, 2026. The breach exposed a range of personal and medical information, including names, dates of birth, Social Security numbers, health records, insurance details, government IDs, and financial data. LHC Group began identifying affected individuals in July 2026 and issued notifications to patients on September 4, 2026. Edelson Lechtzin LLP, a national class action law firm, is now investigating potential legal claims on behalf of impacted individuals, who may face heightened risks of identity theft and fraud. The firm is offering free case evaluations to those who received breach notifications. LHC Group operates across the U.S., serving patients recovering from illness or injury. The incident underscores the ongoing threat of phishing attacks and credential theft in the healthcare sector.