Premise Health, a health care company, has notified people that an employee misappropriated company data, and that the data may include Social Security numbers, health insurance information and treatment information.
The company says the incident was not a hacking or ransomware event. This page explains what Premise Health and state regulators have said so far.
Premise Health Holding Corp’s Data Breach Investigation
Premise Health posted a notice on its website describing a data security incident. According to the notice, on September 18, 2026, the company discovered that an employee had violated company information security policies and had misappropriated certain company data, beginning on or about March 26, 2026. That means the activity went on for months before the company found it.
The company states that this was not a hacking or ransomware event, and that its operations were not interrupted. Its sites remained open to serve patients. After discovering the problem, Premise Health says it revoked the employee’s credentials and system access, validated its security controls and began an investigation. The employee has been terminated, and the company reported the incident to law enforcement.
On October 14, 2026, Premise Health says it received a preliminary analysis of the relevant data. After further analysis and validation, the company began notifying affected individuals that some of their personal information was involved. Premise Health says it is notifying people directly where it has enough contact information, and that it is not aware of any misuse of personal information.
On November 6, 2026, the Vermont Attorney General’s office listed Premise Health Holding Corp in its public table of security breach notices. The entry lists 1,948 affected Vermont residents and names Social Security numbers and health records as the categories of data. That figure counts only Vermont residents. Premise Health has not published a total number of people affected, so the nationwide figure could be much larger.
Insider incidents like this one can be harder to spot than outside attacks, because the person involved may already have legitimate access to records. They also raise a particular concern about how access to sensitive health data is monitored and limited. The notice does not say what the employee’s job was, which systems were accessed, how the data was taken, or why. It also does not say whether any of the data has been used, shared or sold, and this page does not guess.
Premise Health is a health care company, and the notice refers to people’s eligibility for services and their relationship with the company. People may be affected through different relationships, so the notice letter is the best way to learn how your own information came to be held by the company. The notice does not describe who the affected people are beyond that.
Health information combined with a Social Security number is a particularly serious mix. A Social Security number can be used for identity theft and false tax filings. Treatment and insurance details can be used for medical identity theft, such as fraudulent billing or obtaining care or prescriptions in another person’s name, and they can also be used in targeted scams. Unlike a password, none of these details can be easily changed.
The company says it has introduced additional measures to strengthen its security defenses and continues to monitor its systems. It is also offering complimentary credit monitoring to affected individuals, with enrollment details in the letter mailed to them. The notice does not state how long the monitoring lasts, so read the letter for the length of coverage and any enrollment deadline.
If you received a letter from Premise Health, keep it along with the envelope. If you did not receive one but have been a patient, a member or an employee-sponsored participant connected to the company, you can call the number on the company’s web notice to ask whether your information was involved. Use the contact information on the official website rather than a number from an unsolicited message.
When Did This Breach Occur?
Premise Health says it discovered the incident on September 18, 2026. The misappropriation of company data began on or about March 26, 2026, according to the company’s notice.
The company received a preliminary analysis of the relevant data on October 14, 2026, and then began notifying affected individuals. The Vermont Attorney General’s office listed the filing on November 6, 2026. The notice does not say when the activity stopped or give the date letters were mailed.
What Information Was Breached?
According to Premise Health, the information involved varied by individual. Depending on the person, it may have included name, address, date of birth, a government identification number such as a Social Security number, health insurance information, and diagnostic or other treatment information.
It may also have included other information provided to the company in connection with a person’s eligibility for services or relationship with Premise Health. The Vermont entry lists Social Security numbers and health records. Your letter should tell you which items apply to you.
What You Can Do
If you received a notice related to Premise Health Holding Corp or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- If the letter offers free credit monitoring, enroll using the instructions in it. Also review explanation of benefits statements and insurance claims for services you did not receive.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Premise Health Holding Corp
If you received a notice from Premise Health, you may have legal options. A data breach lawsuit can seek compensation for the loss of privacy, the time spent protecting yourself and any out-of-pocket costs, and can press an organization to improve how it safeguards sensitive health information. Whether a claim makes sense depends on the facts of the incident. Keep your notice letter and any records of suspicious activity or expenses, since they may matter later.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
