LHC Group, Inc.

A vished employee handed over account credentials on April 7, 2026, and a threat actor rode them into LHC's third-party vendor platform for eight days, reading patient files until April 15. LHC's own network was never touched; the vendor's login screen was the entire perimeter, and a phone call walked right through it. Clinical summaries, diagnosis codes, Medicare and Medicaid numbers, and some Social Security numbers went out with it. A phone call is not a sophisticated attack; it is a password reset nobody double-checked.