LHC Group Lawsuit: The 2026 Patient Data Breach and Where Things Stand
Reference Guide
If you searched “LHC Group lawsuit” this fall, you most likely got a letter dated September 4, 2026. LHC Group, the Louisiana home health and hospice company, says a voice-phishing attack let an intruder pull patient files from a vendor platform between April 7 and April 15, 2026. As of October 15, 2026, no class action over the breach has been found in public dockets. There is no settlement, no claim form and no payout. The one real deadline is for the free credit monitoring: December 4, 2026.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Happened in the LHC Group Breach
LHC Group provides home health, hospice and community-based care in 28 states and the District of Columbia. It uses an unnamed third-party technology vendor for referral management, care coordination and clinical workflow, so that vendor holds patient records.
According to LHC's own notice, on April 7, 2026 it learned that an employee may have fallen for a vishing (voice-phishing) call. The vendor then reported suspicious activity tied to an LHC user account. LHC says the attacker used the stolen credentials to access “a large volume of files” on the vendor's platform from April 7 through April 15, 2026. LHC notified the FBI and brought in forensic experts. It began confirming who was affected on July 9, 2026, and letters started going out by first-class mail on September 4, 2026.
LHC says it has “no evidence or reason to believe” the data has been misused.
Case details
No breach lawsuit found. As of October 15, 2026, a search of federal court records turned up no class action over the April 2026 breach. What exists so far is law firms advertising “investigations” and asking affected patients to contact them. An investigation is not a lawsuit.
One separate federal case is open: Lanteigne v. LHC Group Inc, No. 5:26-cv-00368 (M.D. Fla.), filed May 22, 2026. That was before the breach letters went out, and the public index doesn't say what the case is about. Don't read it as the breach case.
Older LHC Group cases: In 2011 the Justice Department announced that LHC agreed to pay $65 million to settle False Claims Act allegations about home health billing, without admitting wrongdoing. The same year, the EEOC sued the company for disability discrimination against a nurse in Mississippi (EEOC v. LHC Group Inc., No. 1:11-cv-00355). A shareholder class action, City of Omaha Police & Fire Retirement System v. LHC Group, No. 6:12-cv-1609 (W.D. La.), ended in a $7.9 million settlement with judgment entered March 3, 2015. None of these pays patients anything today.
Status: Breach Disclosed, No Lawsuit or Settlement
The final count is still open. Breach notices filed with state attorneys general add up to more than 28,000 people. LHC gave federal regulators an interim figure of at least 500, which will be updated when its review is finished. This is also the second breach affecting LHC patients disclosed in 2026. LHC was affected by the separate Doctor Alliance vendor breach as well.
Who Is Affected
Current and past patients of LHC Group home health and hospice providers whose records were in the files on the vendor's platform. Many local agencies operate under their own names, so the brand you remember may not be “LHC Group.”
The test is the letter. Affected people were sent a notice dated September 4, 2026. It carries an enrollment code and a return address of P.O. Box 1907, Suwanee, GA. Not every data field was involved for every person. Social Security numbers and financial information were involved only in limited instances, and your letter says which applied to you. Keep it. If a lawsuit is ever filed and settled, it would be your proof of membership.
Is There Any Money?
If a case is filed and eventually settles, healthcare-breach settlements have generally paid back documented out-of-pocket losses, made a small flat payment and offered credit monitoring. That's context, not a forecast. You can model scenarios with our data breach settlement calculator.
LHC Group Breach Timeline
April 7, 2026 — Vishing Call and Vendor Alert
LHC learns an employee may have fallen for a voice-phishing attack. The vendor flags suspicious activity on an LHC user account.
April 15, 2026 — Access Ends
Per LHC, the intruder had access to files on the vendor's platform from April 7 through April 15, 2026.
July 9, 2026 — Affected Patients Identified
After reviewing the files, LHC starts confirming whose information was involved.
September 4, 2026 — Letters and State Filings
Notices go out by first-class mail, and the breach is reported to state attorneys general, including Texas, Massachusetts and Washington.
October 15, 2026 — No Lawsuit on File
Law firms are advertising investigations, but no class action over the breach has been found in federal dockets. No settlement exists.
December 4, 2026 — Monitoring Enrollment Deadline
The last day to enroll in the two years of free IDX credit monitoring, using the code in your letter.
Three Things to Watch For
The stolen files included Medicare and Medicaid numbers and care details. That gives scammers what they need to sound convincing:
A phone call that “verifies” your Medicare number
The breach itself began with a voice-phishing call. Someone who already knows your diagnosis or your home health agency can sound official. Hang up and call your agency or Medicare back on a number you look up yourself.
“Claim your LHC Group settlement”
There is no settlement and no claim form. A page or text asking for your Social Security number or a fee to “secure your payment” is not connected to any court.
Fake credit monitoring enrollment
The real offer uses the code printed in your letter at app.idx.us, and the call center is 1-866-200-0905. Anyone else offering to “activate” LHC monitoring for you, especially for payment, is not part of it.
LHC Group Lawsuit — Questions People Actually Ask
Short answers to the questions people ask most about this case.
Is there an LHC Group lawsuit over the data breach?
As of October 15, 2026, no class action over the April 2026 breach has been found in public federal dockets. Law firms are investigating and asking affected people to contact them, but that's advertising, not a filed case.
What LHC Group lawsuits are going on right now?
The breach has no lawsuit yet. One unrelated federal case, Lanteigne v. LHC Group Inc (M.D. Fla., No. 5:26-cv-00368), has been open since May 22, 2026, and its subject isn't public in the index. Older cases include the $65 million False Claims Act settlement (2011), the EEOC disability suit (2011) and the $7.9 million shareholder settlement (judgment 2015).
Is the LHC Group breach letter real?
LHC published its notice and filed it with state attorneys general. The real letter is dated September 4, 2026, comes from P.O. Box 1907, Suwanee, GA, offers IDX monitoring at app.idx.us and lists the call center 1-866-200-0905. If yours differs, or asks you to pay or call a different number, be suspicious.
What information was exposed?
Per LHC: names, addresses, dates of birth and demographics, clinical summaries, treatment plans, diagnosis codes, dates of service, provider information, health insurance details and Medicare/Medicaid ID numbers. Social Security numbers and financial information were involved only in limited instances. Not every field applied to every person.
How many people were affected?
LHC hasn't published a final total. Notices filed with state attorneys general add up to more than 28,000 people, and the true number is likely higher because not every state publishes counts.
Is there a settlement, claim form or deadline?
No settlement, no claim form and no claim deadline. The only deadline is December 4, 2026, for enrolling in the free IDX credit monitoring offered in the letter.
Do I need to sign up somewhere to be part of a future class action?
No. If a class action is filed and a class is certified or settled, class members are notified directly and included unless they opt out. Signing with a law firm is a separate choice. Read what you sign.
What should I do now?
Enroll in the IDX monitoring before December 4, 2026. Read your Medicare or insurance explanation-of-benefits statements for care you never received. Consider a free credit freeze, and keep the letter. For other open cases, see our list of open class action settlements.
About This Information
- Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated
- $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Data Breach Settlement CalculatorEstimate what a healthcare breach settlement might pay
- Open Class Action SettlementsSettlements currently accepting claims, with deadlines
- Saber Healthcare Group LawsuitA separate case against a long-term care operator
- Settlement Payout CalculatorHow class action funds are divided per person