Advantage Home Health Care Data Breach

Hackers spent a week inside an Advantage Home Health Care server before the company noticed, and took files that may hold patients’ Social Security numbers and medical information. The Muncie, Indiana home health provider waited until August 25, 2026 to send notices.

What Happened at Advantage Home Health Care

Advantage Home Health Care, Inc. (AHHC) is a home health provider based in Muncie, Indiana. It sends nurses, aides and personal care workers into patients’ homes across much of Indiana.

According to the company’s Notice of Data Breach, an unauthorized person first got into one of its computer servers on June 9, 2026. AHHC became aware of the intrusion on June 16, 2026. On June 26, 2026, the company learned that the intruder had taken data that may have included personal information about patients and employees.

AHHC says it notified federal law enforcement and hired cybersecurity specialists. Notices to patients and employees are dated August 25, 2026.

Eleven Weeks From First Access to Notice

The timeline in the notice shows a long gap at each step:

• June 9: the intruder first got into the server
• June 16: AHHC became aware of the intrusion, one week later
• June 26: AHHC learned that data had been taken
• August 25: notices went out, about two months after the company knew data was taken and eleven weeks after the intrusion began

During that time, affected patients and employees had no way of knowing their information was in criminal hands.

A Ransomware Group Claimed the Attack

On July 17, 2026, a ransomware group called The Gentlemen listed Advantage Home Health Care on its leak website, according to SOCRadar, a company that tracks these listings. Ransomware groups steal or lock a company’s files and threaten to publish the data unless they are paid.

AHHC’s notice does not mention ransomware or name any group, and the company has not confirmed the claim.

What Information Was Exposed?

According to the notice, the information for patients may have included:

• First and last name
• Date of birth
• Social Security number
• Address and phone number
• Information about medical conditions and care received

For current and former employees, the information may have included name, date of birth, Social Security number, address, phone number and information about their employment. For employees enrolled in the AHHC health plan, it may also have included health insurance information, plan enrollment information, claims information, healthcare provider information and information about their health benefits.

How Many People Were Affected?

19,851 people were notified, according to HIPAA Journal, which reported the figure on October 5, 2026. AHHC’s own notice does not state a total.

What Is Advantage Home Health Care Offering?

AHHC is offering credit monitoring, a credit report, a credit score and cyber monitoring through Cyberscout, a TransUnion company. The company’s website notice describes the offer as 12 months, while a letter sent to an employee describes 24 months, so the length may depend on the letter. People must enroll within 90 days of the date on their letter.

Questions go to AHHC’s incident response line at 1-888-398-2084, Monday through Friday.

Your Information Is at Risk

A Social Security number combined with a name, date of birth and address gives criminals what they need to open credit, file false tax returns or take out loans in someone else’s name. Medical and health insurance information adds another risk: it can be used to get care, prescriptions or insurance payments under another person’s identity. Unlike a credit card, a Social Security number and a medical history cannot be replaced.

Do You Have Legal Options?

Healthcare providers that hold patients’ Social Security numbers and medical information have a duty to protect it and to notify people promptly when it is exposed. Employers have the same duty for their workers’ records. When that obligation is not met, affected individuals may have legal rights and remedies worth discussing with an attorney. Emery | Reddy is investigating this incident on behalf of people who received a notice letter.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review. No Fee Unless We Recover. Call 916.995.5968.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Much of the information involved in this incident may also qualify as Protected Health Information (PHI). PHI includes medical or healthcare-related data protected under federal and state privacy laws. When PHI is compromised, it can be misused for medical identity theft or insurance fraud.

Frequently Asked Questions

Did Advantage Home Health Care have a data breach?

Yes. Advantage Home Health Care says an unauthorized person accessed one of its servers starting June 9, 2026 and took data that may have included personal information about patients and employees. Notices are dated August 25, 2026.

How many people were affected?

19,851 people, according to HIPAA Journal. The company’s notice does not give a total.

What information was exposed?

For patients:

• Name, date of birth, address and phone number
• Social Security number
• Information about medical conditions and care received

For employees, the information may also include employment details and, for health plan members, health insurance, claims and benefits information.

Why did it take so long to get a letter?

The notice says the intrusion began June 9 and the company knew by June 26 that data had been taken. Letters are dated August 25, about two months later. The company has not explained the delay.

What are the risks when medical information is exposed?

Medical information can be used for medical identity theft, where someone gets care, prescriptions or insurance payments in your name. That can leave false entries in your medical records and bills you did not run up. Check your Explanation of Benefits statements for care you did not receive.

What should I do if I received a letter?

Take these steps:

• Enroll in the Cyberscout monitoring within 90 days of the date on your letter
• Place a free credit freeze with Equifax, Experian and TransUnion
• Review your credit reports and Explanation of Benefits statements
• Be wary of calls, texts or emails that mention the breach or Advantage Home Health Care
• Keep your letter

Do I have a legal claim?

You may. Healthcare providers and employers have a duty to protect the Social Security numbers and medical information they hold and to notify people promptly when it is exposed. If you received a Notice of Data Breach letter from Advantage Home Health Care, contact Emery | Reddy at 916.995.5968 or visit emeryreddy.com for a Free Case Review to see what you may qualify for. No Fee Unless We Recover.