Advantage Home Health Care Data Breach: Indiana Patients and Staff Notified

Advantage Home Health Care, which refers to itself as AHHC, says it became aware on June 16, 2026, that an unauthorized third party had gained access to one of its computer servers. According to its August 25 notice, the company learned on June 26 that the intruder had acquired data that may have included personal information, and its investigation traced the original access back to June 9.

AHHC says it followed its incident response plans, stopped the activity, brought in security and forensic experts, and notified and worked with U.S. federal law enforcement. Threat-intelligence firm DeXpose reported that a ransomware group known as TheGentlemen claimed responsibility on July 17, 2026, in an extortion notice threatening to leak sensitive data unless negotiations began. The company’s notice does not name any group, and the claim has not been independently verified.

The company says the information involved varies by person. For patients, it could include first and last name, date of birth, Social Security number, address, phone number, and information about medical conditions and care received. For current and former employees, it could include the same identifying details plus information about their employment with AHHC.

For employees who were enrolled in the AHHC employee health plan, the notice says the information could also include health insurance and plan enrollment information, claims information, healthcare provider information, and information about health benefits. In its report to Massachusetts regulators, which covered a single resident of that state, the company also marked financial account information as involved, a category its public notice does not list.

AHHC is based in Muncie and describes itself as one of the largest home care providers in Indiana, with nine locations serving 46 counties. Its services range from personal care and housekeeping to skilled staffing, pediatric care and high-tech patient care. The notice’s offer of services for parents and guardians of affected minor patients indicates that children are among those involved, along with adult patients and current and former employees.

The breach report AHHC filed with the U.S. Department of Health and Human Services on August 25, 2026, lists 19,851 affected individuals and describes a hacking incident involving a network server. Massachusetts’ breach report shows one affected resident there. As of this writing, the incident does not appear on the lists maintained by the California, Vermont or Texas attorneys general.

Beyond containing the attack, AHHC says it scanned its environment, added security measures, and will keep evaluating security protocols, continuous monitoring and staff training. The notice also says the company made diligent efforts to prevent the intruder from keeping, further using or disclosing the data it acquired, and that it is not aware of any misuse.

Eligible adults are being offered 12 months of single-bureau credit monitoring, a single-bureau credit report and score, and cyber monitoring through Cyberscout, a TransUnion company, at no charge. Parents and guardians of affected minor patients can receive cyber monitoring for themselves and their children for the same period. Enrollment deadlines differ for adults and minors, so the letter each person received controls the timing.

Many home care patients are older adults or children who may not monitor their own credit, so relatives and caregivers may want to help with these precautions:

• Enroll with the code in your letter before its deadline. Adults and minors have different enrollment terms, so check the date printed on each household member’s letter.
• Consider freezing credit for older adults and children. Social Security numbers were among the data involved, and a freeze for a child under 16 is free at Equifax, Experian and TransUnion, just as it is for adults.
• Review Medicare, Medicaid or private insurance statements for care that never happened. Unfamiliar visits, equipment or services can signal medical identity theft.
• Employees in the AHHC health plan should check their claims history. Plan enrollment and claims data were potentially involved, so look for claims or providers you do not recognize.
• Be skeptical of unexpected calls or texts about the incident. Scammers often reference real breaches, so confirm any request through a source you find yourself before sharing information.

This overview is general information rather than legal advice. A legal professional can explain which rights may apply in your circumstances.

Did an AHHC letter tell you that your Social Security number or medical information may have been involved, or did one arrive for a parent or child in your care? Wilshire Law Firm’s nationally recognized, award-winning team works with people affected by health care data breaches, and our data breach and privacy lawyers can explain whether this incident may support individual or class action claims. We are available 24/7 for free consultations and free case reviews with a legal professional, and there are no fees unless you get paid.

Reach out to Wilshire Law Firm today to have your Advantage Home Health Care letter reviewed.