Almeida Law Group is investigating a data breach at Ohio Living. If you were affected, contact Almeida Law Group.
About Ohio Living
Ohio Living is one of the largest not-for-profit, multi-site senior living organizations in Ohio, founded in 1922 and formerly known as Ohio Presbyterian Retirement Services. Headquartered in Westerville, Ohio, it operates 11 life plan communities across 43 Ohio counties, providing independent living, assisted living, skilled rehabilitation, memory care, and long-term nursing care. The organization also offers home health, hospice, palliative care, physician and nurse practitioner services, a Medicare Advantage plan, and pharmacy services, serving more than 90,000 people annually. Because Ohio Living serves elderly and medically vulnerable populations, it holds highly sensitive personal, financial, and health information for residents, patients, and employees alike.
What Happened?
Ohio Living was listed in a Vermont Attorney General breach report summary dated October 21st, 2026, identifying Social Security numbers and health records as the categories of data involved in the breach.
According to Ohio Living’s own public notice and reporting by HIPAA Journal, an unauthorized actor gained access to Ohio Living’s network on April 16th through April 17th, 2026, during which files containing patient and other personal information were exfiltrated. The breach was detected on April 17th, 2026. Ohio Living reported the incident to the U.S. Department of Health and Human Services on June 12th, 2026, and posted a public notice on its website around June 16th, 2026. The full number of affected individuals has not been publicly confirmed; at least 500 individuals were initially reported to HHS, which is a common placeholder count used while the full scope is still being determined.
The categories of data involved, per Ohio Living’s own notice, include names, addresses, dates of birth, Social Security numbers, medical history information, disability information, diagnostic and treatment information, prescription information, physician information, medical record numbers, health insurance information (including subscriber and group or plan numbers), taxpayer identification numbers, financial account information, and payment card information.
In August 2026, the ransomware group known as “Dark Project” claimed responsibility for the attack and listed Ohio Living on its dark web leak site, alleging that 600 GB of data was stolen. This is an attacker-side allegation reported by Comparitech and has not been confirmed by Ohio Living, which has not publicly attributed the incident to any specific threat actor or confirmed ransomware involvement.
This is Ohio Living’s second known data breach. In July 2018, an unauthorized individual accessed employee email accounts through a phishing attack, exposing the protected health information of 6,510 individuals, including names, Social Security numbers, financial information, dates of birth, medical record numbers, clinical and diagnostic information, and health insurance information. That breach was reported to HHS on September 7th, 2018.
As of mid-2026, multiple law firms, including Shamis & Gentile P.A. and attorneys affiliated with ClassAction.org and consumer.zlk.com, are investigating whether a class action lawsuit can be filed on behalf of affected individuals. No filed class action complaint has been confirmed in available sources as of the research date.
Key Facts at a Glance
- Company or Organization: Ohio Living
- Industry: Healthcare / Senior Living (Not-for-Profit)
- Location: Westerville, Ohio
- Incident type: Unauthorized network access and data exfiltration
- Date of breach: April 16th, 2026
- Date breach discovered: April 17th, 2026
- Date of consumer notification: June 16th, 2026
- Prior breach: Yes — July 2018 phishing attack affecting 6,510 individuals
- Litigation status: Multiple law firms investigating potential class action; no filed complaint confirmed as of research date
- Source: Vermont Attorney General breach report summary; HIPAA Journal; ClassAction.org; ClaimDepot; Comparitech on X; HIPAA Journal (2018 breach)
What Should You Do?
If you received a notification from Ohio Living, review it carefully for enrollment instructions and deadlines for any identity theft protection services offered. Whether or not protection is offered, you should place a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — and monitor your credit reports for unauthorized activity. You can obtain free annual credit reports at AnnualCreditReport.com. Because health records and health insurance information were involved in this breach, also review your Explanation of Benefits statements and request a copy of your medical records to check for any services you did not receive. If you discover signs of fraud or identity theft, report them at IdentityTheft.gov, which provides a personalized recovery plan.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
