Almeida Law Group is investigating a data breach at Elara Caring. If you were affected, contact Almeida Law Group.
About Elara Caring
Elara Caring is one of the largest providers of home-based care in the United States, offering skilled home health, hospice, personal care, behavioral health, and palliative care services. The company is headquartered in Dallas, Texas, and operates across more than 200 locations in 16 to 18 states with approximately 26,000 caregivers. Because Elara Caring provides medical services directly to patients, it handles sensitive personal health information as a routine part of its operations.
What Happened?
Elara Caring was listed in a Texas Attorney General data security breach report published on June 25th, 2026. The incident stemmed from a cyberattack on a third-party vendor — identified by HIPAA Journal as Doctor Alliance, a platform used to manage and facilitate electronic physician signatures. An unauthorized actor accessed and downloaded documents from the vendor’s systems during two windows: November 4th through 6th, 2025, and November 14th through 17th, 2025. Elara Caring’s own systems were not compromised. The vendor notified Elara Caring of the incident on December 12th, 2025. By March 12th, 2026, Elara completed its review and determined that patient information was among the affected documents. Notification letters were mailed to affected individuals on May 12th, 2026 — approximately five months after Elara first learned of the breach. The information involved includes names, medical information, health insurance information, and dates of birth. A total of 22,172 individuals were affected. Complimentary credit monitoring was offered to affected individuals, and Elara Caring has ended its relationship with the vendor.
This is Elara Caring’s second known data breach. In late 2020, the company experienced a phishing attack involving unauthorized access to employee email accounts between December 9th and 16th, 2020, which exposed the protected health information of 100,487 patients. That incident was reported to the HHS Office for Civil Rights on February 24th, 2021. Regarding the current breach, multiple law firms have announced investigations into potential class action claims, including Edelson Lechtzin LLP, which announced its investigation on May 19th, 2026. No class action lawsuit has been filed as of the time of this writing.
Key Facts at a Glance
- Company or Organization: Elara Caring
- Industry: Healthcare – Home-Based Medical Provider (Home Health, Hospice, Personal Care, Behavioral Health, Palliative Care)
- Location: Dallas, Texas
- Incident type: Unauthorized access to and download of documents from a third-party vendor’s systems
- Date breach discovered: April 17th, 2026
- Date of consumer notification: May 12th, 2026
- Total persons affected: 22,172
- Identity theft protection offered: Complimentary credit monitoring
- Prior breach: Yes — 2020 phishing attack affecting 100,487 patients
- Litigation status: No lawsuit filed; law firm investigations announced by Edelson Lechtzin LLP and attorneys working with ClassAction.org
- Source: Texas Attorney General data security breach report (BR-0005132): https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005132; HIPAA Journal: https://www.hipaajournal.com/data-breaches-elara-caring-excelas-pulpdent-corp/; Edelson Lechtzin LLP investigation announcement: https://www.globenewswire.com/news-release/2026/05/19/3297112/0/en/elara-caring-data-breach-edelson-lechtzin-llp-launches-data-breach-investigation-into-exposure-of-personal-and-health-information.html
What Should You Do?
If you received a notification letter from Elara Caring, enroll in the complimentary credit monitoring offered before any stated deadline. Beyond that, consider placing a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — to help prevent new accounts from being opened in your name. Review your credit reports for unfamiliar activity at AnnualCreditReport.com, where you can access free reports from all three bureaus. Because health and insurance information was involved in this breach, also review your Explanation of Benefits statements and any medical records for services you did not receive, which can be a sign of medical identity theft. If you spot suspicious activity, report it at IdentityTheft.gov.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
