Elmwood Home Care Data Breach Exposes Personal and Medical Information

Elmwood Home Care, a Medicare-certified home health care organization serving Rhode Island and Massachusetts, disclosed a data breach involving unauthorized access to its computer systems between January and February 2026. The total number of individuals affected across the United States has not been publicly disclosed.

The breach was reported to the Vermont Attorney General on June 10, 2026. The company posted a notice about the incident on its website on April 17, 2026.

The breach was the result of a ransomware attack on Elmwood Home Care's computer systems. The organization became aware of suspicious activity in its environment and launched an investigation with the assistance of third-party cybersecurity specialists.

The investigation determined that between Jan. 24 and Feb. 13, 2026, an unauthorized actor accessed certain systems within the company's network. The attacker may have viewed or copied files during that time.

On March 8, 2026, a ransomware group known as Lockbit 5.0 claimed responsibility for the attack on a dark web forum hosted on the Tor network. The group claimed to have obtained the organization's data and announced plans to publish it within 12 to 13 days.

The company began reviewing the potentially affected data to determine what information may have been compromised and to identify the individuals who may have been impacted. The investigation and data review remains ongoing.

The types of information involved may vary by individual but includes names, Social Security numbers, dates of birth, driver's license numbers and other demographic detail, medical information and health insurance policy numbers.

Elmwood Home Care's response to the breach

Elmwood Home Care is reviewing its existing policies and procedures and implementing additional administrative and technical safeguards to help protect information in its care.

Elmwood Home Care stated it would provide affected individuals with additional information, including notification by mail or secure posting.

The company encouraged potentially affected individuals to remain vigilant by reviewing their account statements, free credit reports and explanations of benefits for any unusual activity or errors. The company also recommended that individuals promptly report any suspicious activity or incorrect information to their credit card company, bank, health care provider or insurance company.

Individuals with questions about the incident can reach Elmwood Home Care by calling 833-374-2019 or by writing to 120 Dudley St., Suite 201, Providence, RI 02905. They may also send questions by email to ProviderInquiries@ElmwoodHealthCare.com.