Hackers took Social Security numbers and diagnoses on 126,196 patients from a Texas home health and hospice firm

AngMar Management Services, a Mansfield, Texas company that runs business operations for home health and hospice providers, has told federal regulators that hackers stole patient data on 126,196 people. The stolen files include Social Security numbers and diagnosis details, an unusually sensitive combination for patients who were receiving end-of-life or home-based care.

Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.

Subscribe to TLDR →

We may earn a commission if you sign up.

The ransomware group Interlock claimed responsibility in August, boasting of more than 700 GB of stolen data. AngMar did not confirm the theft of patient information until early September, and the count reached the federal government’s breach list in the week before SecurityWeek’s Oct. 5 report.

AngMar’s role behind home health and hospice providers

According to SecurityWeek, AngMar provides business operations, administration and support network management for home health and hospice care providers. That makes it a business associate under federal health-privacy rules, a vendor that holds patient files on behalf of the care providers rather than treating patients itself. The HHS breach portal lists AngMar as a business associate in Texas with 126,196 individuals affected, a Hacking/IT Incident on a network server, submitted on Sept. 16, 2026.

Business associates are a recurring weak point because they gather patient files from many care providers in one place. The group behind this attack, Interlock, has racked up about 129 victims since late 2024 and mostly targets organizations in the Americas, according to the Paubox analysis. A vendor serving several hospice and home health operators is the kind of target that yields a large haul for a single intrusion, and it explains how one Texas management firm ended up holding records on more than 126,000 people.

Timeline from July intrusion to September confirmation

AngMar identified suspicious activity on its systems in mid-July. A HIPAA Journal summary of the company’s notice says an unauthorized person may have accessed patient files on or around July 18, and that AngMar identified the incident on July 20. The company’s review was completed on Sept. 8, 2026, when the types of data involved were confirmed.

In between, Interlock added AngMar to its Tor-based leak site in August. A Paubox analysis reported that the group claimed about 710 GB and posted a screenshot of folders it said came from AngMar, and noted that the claim is difficult to verify. The group also said AngMar “disregard[s] the safety of their clients and the people they care for,” which the analysis read as a sign that no ransom was paid.

ClassAction.org’s summary of the case says AngMar manages home health and hospice providers across 11 states, so the 126,196 people are spread well beyond Texas. HIPAA Journal, citing the Texas Attorney General, puts the Texas residents at 35,916, which means roughly seven in ten of those affected live elsewhere. Paubox reported that AngMar’s breach notice to the Massachusetts Attorney General is dated Sept. 22, 2026.

What was taken and what AngMar is offering

SecurityWeek lists the stolen data as names, birth dates, Social Security numbers, diagnosis details, medical history, health insurance information, patient IDs, provider names, prescription details and dates of service. A listing of AngMar’s state filings at ClaimDepot adds that at least 35,916 of the affected people are Texas residents and that the company is offering complimentary single-bureau credit monitoring through Cyberscout, a TransUnion company, with enrollment due within 90 days of the letter date.

The company said it has implemented additional security measures, according to HIPAA Journal. A Social Security number cannot be changed the way a password can, and a diagnosis or prescription history can be used to build convincing medical-fraud or phishing scams, so the credit monitoring covers only part of the exposure. A toll-free assistance line, 1-877-520-9311, is listed for questions.

Attorneys working with ClassAction.org said, as of the page’s September 23 update, that no lawsuit had been filed and that they were investigating whether one could be brought. For patients who receive a letter, the practical steps are the ordinary ones: take the monitoring offer, consider a credit freeze, and watch insurance statements for services never received.

The second breach in the same SecurityWeek report

SecurityWeek’s Oct. 5 story covered two incidents, which is why its combined count tops 250,000 people. The other was at Clover Health Investments of Jersey City, New Jersey, where attackers used social engineering to compromise three non-managerial health plan employee accounts in early July, as SecurityWeek first reported when the company disclosed the intrusion in July. Clover told HHS in mid-September that 138,677 people were affected.

Together, the two companies’ HHS-reported figures come to 264,873 people. The AngMar share is the smaller of the two, but its stolen data is arguably the more dangerous: Clover’s stolen fields were names, dates of birth, insurance identifiers and account identification numbers, while AngMar’s include Social Security numbers, diagnoses and prescription details.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

Tech news in one quick read: Subscribe to TLDR →

We may earn a commission if you sign up.