Sharecare Health Data Services, LLC has sent notice letters about a data security incident at its records release business. This page explains what the notice says, what has not been disclosed, and what steps people can take.
Sharecare Health Data Services, LLC’s Data Breach Investigation
Sharecare Health Data Services, LLC is based in Atlanta, Georgia. According to its notice letter, the company provides records release services for health providers, helping produce medical records in response to requests from patients, their attorneys and other requestors. People may therefore have been notified even if they never dealt with the company directly, because it received their information through its work for a healthcare provider.
The notice letter, dated November 6, 2026, was filed with the Massachusetts Attorney General. It says that as a result of a cybersecurity incident, the company learned that an unauthorized actor gained access to its network environment and exfiltrated a limited number of files. Exfiltrated means the files were copied out of the network, not merely viewed. The company says it worked to contain the threat, started an investigation, and worked with outside cybersecurity professionals.
After a forensic investigation and a manual document review, the company says it discovered on August 19, 2026 that the affected systems, which were accessed on or about July 17, 2026, contained personal information and in some cases protected health information. The company says it has been in communication with the healthcare entity whose records were involved, and that the entity asked the company to send notice directly to affected people.
The letter says medical records were not compromised. It says the documents involved included records request pages, authorization documents and other similar request-related documentation. The letter states that the personal information involved includes the recipient’s full name, followed by additional data elements that are blank in the copy filed with the state. This page does not guess at what those elements are.
The company says it has no knowledge that anyone’s information has been or will be misused as a direct result of the incident. The letter also says Rhode Island residents were affected, but the number is blank in the filed copy, and no total count has been published. The names of the healthcare providers involved are also blank in the filed copy, so people who receive a letter should check which provider it says is connected to them.
A records release request can contain more than a name. A request form or authorization may include a patient’s address, date of birth, the provider or facility involved, the dates of treatment, and the name of the person or law firm asking for the records. The letter does not say which of those, if any, were in the exposed files. Even without clinical records, that kind of information can reveal that a person was treated at a particular provider, which many people consider private.
The delay between the incident and the notice is also worth noting. Files were accessed on or about July 17, 2026, the company discovered on August 19, 2026 what the files contained, and the letters are dated November 6, 2026. Reviewing documents by hand to work out whose information is involved can take a long time, but it also means people may have gone months without knowing their information was in the hands of an unauthorized party.
Healthcare vendors are common targets because they hold information from many providers in one place. A single intrusion at a vendor can affect patients of several unrelated hospitals or practices, which is why people sometimes receive a letter from a company they have never heard of. The letter should say which provider the company received your information from, and that provider is the best place to ask follow-up questions.
Scammers sometimes follow publicized incidents with calls or messages that claim to be about a medical records request, a lawsuit or a billing problem. Do not click links or provide personal information in response to an unexpected message. Use contact details from an official source rather than from the message itself, and watch your explanation of benefits statements for services you do not recognize.
Attorneys reviewing incidents like this one look at whether the organization took reasonable steps to protect personal information and whether affected people may have legal options. This page relies only on the filed notice letter and may be updated as more information becomes available.
When Did This Breach Occur?
According to the notice letter, the affected systems were accessed on or about July 17, 2026. The company says it discovered on August 19, 2026 that those systems contained personal information, and the letter is dated November 6, 2026.
What Information Was Breached?
The company says medical records were not compromised. It says the documents involved included records request pages, authorization documents and other request-related documentation, and that the personal information includes the recipient’s full name along with additional data elements that are not filled in on the copy filed with the state. The letter also says protected health information may have been involved.
What You Can Do
If you received a notice related to Sharecare Health Data Services, LLC or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Review explanation of benefits statements from your insurer and ask your provider or insurer about any service you do not recognize, since the letter says protected health information may have been involved.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Sharecare Health Data Services, LLC
If you received a notice from Sharecare Health Data Services, LLC, or you believe your personal information was exposed in this incident, you may have legal options. Whether you can seek compensation depends on the facts, and an attorney can explain whether you may be able to join a class action lawsuit over the exposure of your personal information.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
