Breaches and incidents
LHC Group (Lafayette, Louisiana home health): vishing attack in vendor-linked incident, over 28,000 affected
Per HIPAA Journal, LHC Group was hit by an incident involving a third-party technology vendor.
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- Per HIPAA Journal, LHC Group was hit by an incident involving a third-party technology vendor; “an employee may have fallen victim to a voice phishing attack”, and the threat actor had access from 7 to 15 Apr 2026. State AG notices show more than 28,000 affected; data includes clinical summaries, treatment plans and in some cases SSNs or financial data.
- Root cause: voice phishing of an employee.
- No attacker named.
- LHC disabled the compromised account and offers two years of monitoring; this is its second 2026 breach after the Doctor Alliance vendor incident.