Triniti Home Health and Hospice, a nursing and end-of-life care company serving the greater Twin Cities, Minnesota area, is reportedly the target of a cyberattack that may have compromised sensitive information belonging to patients, their families, and staff.
Companies entrusted with medical and personal information have a responsibility to keep that data secure, and when a breach occurs, those affected deserve to understand what happened and what options may be available to them.
Triniti Home Health and Hospice’s Data Breach Investigation
Attorneys are investigating a possible data breach affecting Triniti Home Health and Hospice, a nursing and end-of-life care provider serving the greater Twin Cities, Minnesota area. According to a September 15, 2026 post on the dark web monitoring site Ransomware.live, the hacker group SafePay claimed responsibility for an attack on the organization, estimated to have occurred the same day. A separate cybersecurity blog, HookPhish, independently reported the same claim, stating that SafePay was behind the alleged attack. As of this writing, Triniti Home Health and Hospice has not publicly confirmed the incident, and no formal notification has been issued to affected individuals.
Home health and hospice providers occupy a uniquely sensitive position in the personal data ecosystem. In the course of delivering nursing and end-of-life care, these organizations routinely collect and store highly sensitive information, including patients’ names, dates of birth, Social Security numbers, medical histories, diagnoses, treatment plans, medications, and health insurance details, along with contact information for family members and caregivers. Because this information is both extensive and deeply personal, healthcare organizations like Triniti Home Health and Hospice have increasingly become attractive targets for ransomware groups looking to extract data they can threaten to leak or sell if a ransom is not paid.
Ransomware groups like SafePay typically operate under a double-extortion model, in which the group exfiltrates data before encrypting a victim’s internal systems, then threatens to publish that data on a dark web leak site if payment is not made. A public claim of this kind, even before a company issues an official statement, is often the first public sign that a broader investigation and eventual notification process may follow. Many state laws, including Minnesota’s, require organizations to notify affected individuals within a set window once a breach involving personal or medical information is confirmed, though the exact timeline can vary depending on the nature and scope of what was exposed.
For those affected by breaches involving healthcare providers like Triniti Home Health and Hospice, the practical risk generally comes down to what categories of information were exposed. A breach that includes Social Security numbers, medical records, or health insurance information carries a materially higher risk of identity theft, insurance fraud, and medical fraud than one limited to basic contact information. Until Triniti Home Health and Hospice discloses more specifics, it remains unclear which of its patients, family members, or staff may have had sensitive information compromised, or what categories of data were included in the reported exposure.
Ransomware attacks against home health and hospice agencies have become increasingly common in recent years, in part because these organizations often manage large volumes of sensitive medical data while operating with more limited cybersecurity budgets than large hospital systems. Attackers frequently view smaller healthcare providers as easier entry points, while the data they hold can be highly valuable on dark web marketplaces or useful for follow-on phishing and medical identity theft schemes targeting the individuals whose information was exposed.
Once a ransomware group publicly claims responsibility for an attack, affected organizations typically must undertake a forensic investigation to determine the full scope of what was accessed before any formal notification can go out to those impacted. This process can take weeks or months depending on the complexity of the breach, and individuals are often left without clear information about their own exposure until that process concludes. Attorneys are interested in speaking with anyone affiliated with Triniti Home Health and Hospice, including current and former patients, family members, and staff, who is concerned that their information may have been exposed.
In the healthcare sector specifically, a data breach can also expose patients to medical identity theft, where a bad actor uses stolen information to fraudulently obtain medical services, prescriptions, or insurance reimbursements in someone else’s name. This can lead to incorrect information appearing in a person’s medical records, denied insurance claims, and a lengthy process to correct the resulting errors, on top of the more familiar risks of financial fraud tied to a stolen Social Security number.
When Did This Breach Occur?
According to a September 15, 2026 post on the dark web monitoring site Ransomware.live, hacker group SafePay claimed the attack occurred the same day the post was made. Triniti Home Health and Hospice has not publicly confirmed a breach date, and no formal notification letters describing the incident’s timeline have been made public as of this writing.
What Information Was Breached?
SafePay claimed responsibility for the attack on Triniti Home Health and Hospice, but the specific categories of information involved, such as names, Social Security numbers, medical records, or health insurance details, have not been publicly disclosed. Given that Triniti Home Health and Hospice provides nursing and hospice care, any exposed data could plausibly include sensitive medical and personal information belonging to patients and their families, but this has not been confirmed.
What You Can Do
If you are affiliated with Triniti Home Health and Hospice and are concerned your information may have been exposed, there are steps you can take to help protect yourself:
- Monitor your financial accounts, credit reports, and health insurance statements for any unauthorized activity.
- Consider placing a fraud alert or credit freeze with the major credit bureaus.
- Be cautious of unsolicited emails, calls, or texts referencing Triniti Home Health and Hospice or asking for personal or medical information.
- Keep any notification correspondence you receive, as it may serve as proof you were affected.
- Enroll in identity theft protection or credit monitoring services if offered.
File a Data Breach Lawsuit Against Triniti Home Health and Hospice
If you believe your information was compromised as a result of this reported breach, you may have legal options available to you. Attorneys are currently investigating whether a class action lawsuit can be filed on behalf of those affected.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
