VNA Texas Data Breach Affects 28,515 People, Exposing SSNs and Medical Info

On July 17, 2025, Visiting Nurse Association of Texas (VNA) experienced unusual activity on its network. An investigation found that an unauthorized person accessed certain information in employee email accounts. VNA reported the breach to the U.S. Department of Health and Human Services on Oct. 10, 2025, listing 28,515 people affected. The breach affected 14,798 Texans, up from 12,673 in an earlier filing.

According to the disclosure filed with the Texas Attorney General on Jan. 30, 2026, an unauthorized party gained access to sensitive consumer information.

The exposed data included a combination of personally identifiable information (PII) and protected health information (PHI): names, Social Security numbers, driver’s license numbers, government-issued ID numbers such as passports and state ID cards, dates of birth, medical information, health insurance details, medical record number, mental or physical condition, diagnosis, diagnosis code, treatment location, provider name, admission date, prescription information, subscriber member number, and client ID number.

VNA posted a notice of the incident on its website and updated it on Jan. 30, 2026. The incident was also disclosed to the Massachusetts Office of Consumer Affairs and Business Regulation.

Visiting Nurse Association of Texas’s response

Following the discovery of the breach, VNA took steps to notify affected individuals and the public. Notices were sent by U.S. Mail, published in print media, and posted on the company's website.

VNA is offering 24 months of free credit monitoring through Cyberscout, a TransUnion company. People with questions can call 1-844-784-5324, Monday through Friday, 8 a.m. to 8 p.m. Eastern time, excluding U.S. holidays.

VNA has encouraged those potentially impacted to remain vigilant by monitoring their financial accounts, reviewing credit reports, and watching for suspicious activity related to their medical or insurance records. Given the types of information exposed, affected individuals should consider placing a fraud alert or credit freeze with major credit bureaus and report any suspicious incidents to the appropriate authorities.

VNA’s public notice includes additional resources and instructions for those seeking support and guidance.