Open Arms Care Corporation Data Breach Exposes Sensitive Health and Personal Information In August 2025, Tennessee-based Open Arms Care Corporation detected unusual activity in a company email account, triggering an investigation that revealed unauthorized access or acquisition of emails between June and August of that year. The breach potentially compromised a range of sensitive data, including names, Social Security numbers, medical diagnoses and treatment details, health insurance information, and, in limited cases, financial account details. Operating 50 residential facilities for individuals with developmental and intellectual disabilities, Open Arms Care completed its assessment of affected individuals on April 30, 2026, and began sending notification letters to potentially impacted parties on June 9. The breach has drawn legal scrutiny, with attorneys investigating the possibility of a class action lawsuit on behalf of those affected, seeking compensation for privacy violations, time spent addressing the breach, and out-of-pocket costs. The incident underscores ongoing risks to protected health and personal information within healthcare organizations. No further details on the breach’s origin or the number of affected individuals have been disclosed.

Open Arms Care Discloses 2015 Data Breach After 11-Year Investigation Open Arms Care Corp. recently revealed a data security incident involving unauthorized access to its email accounts, which occurred between June and August 2015. The company detected unusual activity in its email systems in August 2015 and launched an investigation with independent cybersecurity experts to assess the breach’s scope. The investigation concluded that sensitive personal data including names, Social Security numbers, medical diagnoses, treatment details, and health insurance information may have been accessed or acquired without authorization. In some cases, financial account information was also exposed. The breach was confined to email accounts and did not affect other company systems. After an extensive review, Open Arms Care completed its assessment of affected individuals on April 30, 2026, nearly 11 years after the initial detection. The company then gathered updated contact information to notify those impacted. A data privacy notice was posted on its website on June 6, 2026, followed by the mailing of notification letters on June 9, 2026. In its response, Open Arms Care apologized for the incident and outlined steps for affected individuals to protect their personal information, including placing fraud alerts, requesting credit reports, and reporting suspicious activity. The company also established a toll-free call center (1-833-718-9788) for inquiries, available Monday through Friday, 8 a.m. to 8 p.m. Central Time. Open Arms Care stated it is implementing measures to prevent future breaches and reminded affected individuals of their rights under the Fair Credit Reporting Act, including the ability to dispute inaccurate credit file information.