Evergreen Healthcare Data Breach Exposes Social Security Numbers

On Dec. 3, 2025, Couve Healthcare Consulting, LLC, which does business as Evergreen Healthcare Group, discovered unauthorized activity within their cloud-based healthcare platform.

The incident was investigated, revealing that an unauthorized party may have accessed files containing sensitive personal information. After a thorough review, the company determined that the exposed data included names, Social Security numbers, dates of birth and medical information.

While the total number of affected individuals nationwide has not been disclosed, the breach impacted at least two people in Massachusetts, according to the disclosure filed with the Massachusetts Office of Consumer Affairs and Business Regulation.

Affected individuals began receiving notifications by mail on Feb. 24, 2026. The company also posted a public notice on its website to reach anyone who could not be contacted directly.

The severity of this breach is notable due to the nature of the information exposed. The combination of Social Security numbers, dates of birth and medical details increases the risk of identity theft and medical fraud.

Evergreen Healthcare Group's response

To support those affected, the EHG is offering complimentary single-bureau credit monitoring, credit report and credit score services for 24 months through Cyberscout, a TransUnion company specializing in fraud assistance and remediation.

Impacted individuals are encouraged to enroll in these services within 90 days of receiving their notification letter. The company has also provided a dedicated toll-free hotline at 855-522-1474 for questions or to confirm whether an individual's information was involved.

Given the sensitive nature of the information exposed, affected individuals should remain vigilant for incidents of fraud or identity theft. It is recommended to regularly review credit reports and financial account statements, consider placing a fraud alert or security freeze on credit files and promptly report any suspicious activity to financial institutions, credit bureaus or law enforcement.

Additional resources and contact information for the major credit reporting agencies are provided in the company's notice.