Almeida Law Group is investigating a data breach at Friesen Group. The breach occurred on May 15th, 2025. If you were affected, contact Almeida Law Group.
About Friesen Group
Friesen Group, formerly known as Owens Healthcare, is a family-led company based in Redding, California, that has served Northern California since 1957. It provides business consulting, accounting, human resources, marketing, and IT support to a portfolio of healthcare companies, including Owens (medical equipment and respiratory services), Wellscript (infusion therapy), Lifemed (long-term care pharmacy), and J3 (commercial real estate). Because Friesen Group serves as a back-office services provider to multiple healthcare brands, it handles protected health information as a business associate or covered entity, and its breach was reported to the U.S. Department of Health and Human Services.
What Happened?
Friesen Group was listed in a California Attorney General sample breach notice dated September 21st, 2026. According to that notice and supplemental reporting, on May 19th, 2025, Friesen Group received a suspicious email indicating that data stored on its network may have been at risk. The company launched an investigation with independent forensic experts. That investigation confirmed on July 15th, 2025, that an unauthorized user gained access to Friesen’s network for a limited period of time and may have accessed data. Friesen Group reported the incident to the U.S. Department of Health and Human Services on August 8th, 2025, characterizing it as a hacking and IT incident involving unauthorized access to a network server and affecting approximately 500 individuals. The company completed its individual-level determination of who was affected on July 16th, 2026 — roughly 14 months after the breach occurred — and the California AG notice is dated September 21st, 2026.
The notice itself uses placeholder text (“test data”) in the field where exposed data categories would normally appear, which means the actual data types for affected individuals are not confirmed by the company’s own notice letter. Based on the HHS breach report, as described by law firms that have reviewed it, the information involved includes names, medical information, and other protected health information. One third-party aggregator has reported a broader set of potentially exposed data — including addresses, dates of birth, Social Security numbers, driver’s license numbers, health insurance information, and financial information — but that list has not been independently confirmed by Friesen Group’s own disclosures. Friesen Group is offering 12 months of identity theft protection services through Cyberscout, a TransUnion company, to affected individuals. Multiple law firms, including Federman & Sherwood, Srourian Law Firm, and Dapeer Law/JoinTheCase, have announced investigations into potential class action lawsuits, though no class action has been filed as of the research date. No ransomware group has publicly claimed responsibility for this incident.
Key Facts at a Glance
- Company or Organization: Friesen Group (formerly Owens Healthcare)
- Industry: Healthcare services / holding company for healthcare brands (medical equipment, respiratory services, infusion therapy, long-term care pharmacy)
- Location: Redding, California
- Incident type: Hacking / unauthorized access to a network server
- Date of breach: May 15th, 2025
- Date breach discovered: May 19th, 2025
- Date of consumer notification: September 21st, 2026
- Total persons affected: Approximately 500
- Identity theft protection offered: Yes — 12 months of credit monitoring through Cyberscout (a TransUnion company)
- Enrollment deadline: 90 days from the date of the notice letter (September 21st, 2026)
- Litigation status: Class action investigations announced by Federman & Sherwood (announced August 15th, 2025), Srourian Law Firm, and Dapeer Law / JoinTheCase; no lawsuit filed as of the research date
- Source: California Attorney General sample breach notice; Federman & Sherwood investigation; JoinTheCase investigation; Friesen Group website
What Should You Do?
If you received a notice from Friesen Group, consider enrolling in the free 12-month credit monitoring service through Cyberscout at bfs.cyberscout.com/activate within 90 days of the date on your notice letter. You should also place a fraud alert or credit freeze with one or more of the three major credit bureaus — Equifax, Experian, and TransUnion — to make it harder for someone to open new accounts in your name. Review your financial account statements, explanation of benefits statements from your health insurer, and medical records for any unfamiliar activity. You are entitled to one free credit report per year from each of the three major bureaus through AnnualCreditReport.com, and staggering requests every four months lets you monitor your credit year-round at no cost. If you suspect your information has been misused, visit IdentityTheft.gov to report the incident and get a personalized recovery plan.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
