Data breaches have been announced by multiple North Carolina rehabilitative care practices, senior living and skilled nursing care providers in Ohio and Washington, and the California-based nonprofit foundation The Health Trust and its subsidiary, FASS.
North Carolina Rehabilitation Practices Notify Patients About November Hacking Incident
The operator of multiple clinical, long-term, and rehabilitative care practices in North Carolina has reported a data security incident that has affected almost 4,000 patients of Elevate Health & Rehabilitation, Bear Mountain Health and Rehabilitation, and Swannanoa Valley Health and Rehabilitation.
On June 1, 2026, the operator learned that there had been unauthorized access to files maintained by an unnamed third-party vendor, and some of those files had been copied by a bad actor. The unauthorized third party used stolen credentials to log in to its system between November 25, 2025, and November 28, 2025. The obtained files contained patient information such as names, addresses, email addresses, dates of birth, Social Security numbers, driver’s license numbers, patient account numbers, diagnoses, and other health information.
Assurances were received that the stolen data has been deleted and was not published online, which suggests that the vendor paid a ransom. The compromised credentials have been disabled, passwords reset, and additional steps have been taken to strengthen security and the privacy of patient information. The data breach was reported to the HHS’ Office for Civil Rights by Asheville Victoria NC Opco LLC as affecting 1,551 patients of Elevate Health & Rehabilitation; Asheville Beaverdam NC Opco LLC, as affecting 1,397 patients of Bear Mountain Health and Rehabilitation; and Asheville US Seventy NC Opco LLC, as affecting 1,045 patients of Swannanoa Valley Health and Rehabilitation.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Ohio Skilled Nursing Care Provider Hit with Medusa Ransomware Attack
Atrium Centers Inc., a Columbus, Ohio-based skilled nursing and rehabilitation care provider, has alerted patients about an October 2025 cybersecurity incident. Unusual activity was identified within certain computer systems on or around October 13, 2026. Assisted by third-party cybersecurity experts, Atrium Centers determined that an unauthorized third party had accessed certain computer systems between October 8, 2025, and October 12, 2025. During that time, files containing patient and employee data were viewed or copied.
The files were reviewed and found to contain names, contact information, demographic information, dates of birth, Social Security numbers, driver’s license numbers, patient ID numbers, medical record numbers, medical information, health insurance information, financial account information, claims information. The file review is ongoing, and the number of affected individuals has yet to be publicly disclosed. Notification letters will be mailed to the affected individuals when that process is completed. Atrium Centers said it is enhancing its technical safeguards to prevent similar incidents in the future.
Rockwood Retirement Communities Discloses February 2026 Hacking Incident
Spokane United Methodist Homes, doing business as Rockwood Retirement Communities, a Spokane, Washington-based senior living organization, has started notifying individuals impacted by a February 2026 hacking incident. Suspicious network activity was identified on or around February 16, 2026. Immediate action was taken to secure its systems, and third-party cybersecurity and digital forensics experts were engaged to investigate the activity. The investigation confirmed unauthorized network access and the exfiltration of files from its network.
Third-party data review experts conducted a comprehensive and time-consuming review of the affected data, contact information was verified, and notification letters were sent to the affected individuals. Those processes were completed on July 27, 2026. Data compromised in the incident included personal and protected health information such as names, Social Security numbers, dates of birth, driver’s license numbers/state identification numbers, passport numbers, financial account information, Medicaid/Medicare numbers, medical information, and/or health insurance information. Rockwood Retirement Communities is unaware of any actual or attempted misuse of that data.
The HHS’ Office for Civil Rights (OCR) has been informed, but the data breach has yet to be added to the OCR data breach portal, so it is currently unclear how many individuals have been affected.
Qilin Claims Responsibility for The Health Trust Hacking Incident
The Health Trust, a San Jose, California-based nonprofit foundation that provides services to governmental and non-governmental organizations to help build health equity and improve health outcomes, has identified a hacking incident that also affected its subsidiary, Financial Administrative Support Services (FASS).
On May 26, 2025, FASS identified suspicious activity within its computer network. Steps were immediately taken to secure its network; however, on June 11, 2025, further suspicious activity was identified. All systems were immediately taken offline while security was assessed and the activity was investigated. The forensic investigation determined that there had been unauthorized access to certain systems prior to March 26, 2025, and again between June 8, 2025, and June 11, 2025.
Files on the compromised parts of the network were accessed or copied. The review determined that they contained names, Social Security numbers, financial account information, government-issued identification numbers, medical information, and health insurance information. Internal data privacy and security policies, procedures, and protocols have been reviewed, and additional security measures have been implemented to prevent similar incidents in the future. The affected individuals have been offered complimentary credit monitoring services. The Qilin threat group claimed responsibility for the incident and said it exfiltrated 408 gigabytes of data.
The post Hacking Incidents Announced by Rehabilitative Care Providers and Senior Living Facilities appeared first on The HIPAA Journal.
