AngMar Management Services, a Texas-based company that manages home health and hospice providers operating under brands including Angels Care Home Health across multiple states, is reportedly the target of a ransomware attack. A hacker group has claimed to have stolen a large volume of sensitive data, including patient medical records, raising serious concerns for the patients, families, and staff connected to the agencies AngMar oversees.
Companies entrusted with medical records, Social Security numbers, and other deeply personal information have a legal and ethical responsibility to protect that data from unauthorized access. When that protection fails, the people whose information was exposed can be left vulnerable to identity theft, medical fraud, and other lasting harm.
AngMar’s Data Breach Investigation
Attorneys are investigating a possible data breach affecting AngMar Management Services after a hacker group calling itself Interlock claimed responsibility for an attack on the company. According to an August 11, 2026 post on a dark web monitoring site, Interlock alleged that it had obtained approximately 710 gigabytes of data from AngMar’s systems, including patient medical records and other confidential information tied to the home health and hospice agencies the company manages. A separate cybersecurity blog independently reported the same claim shortly after it surfaced.
As of this writing, AngMar has not publicly confirmed the incident, and no official notice appears to have been issued to affected patients, families, or employees. The claims currently rest on the hacker group’s own dark web posting rather than a formal company disclosure or a filing with any state attorney general’s office. This is a common early stage for a breach investigation: threat actors frequently post to leak sites or dark web forums well before a company completes its own internal investigation or begins notifying those impacted, and companies often take weeks or months to confirm the scope of an intrusion once it has been detected.
Ransomware attacks like the one alleged here have become an especially persistent threat to healthcare-adjacent businesses. Companies that manage home health and hospice operations sit on enormous stores of protected health information spread across multiple facilities and providers, which can make centralized data systems an attractive target for cybercriminals seeking to extract and monetize stolen records. Health records in particular tend to fetch a premium on dark web marketplaces because, unlike a credit card number, they cannot simply be canceled and reissued once compromised.
If confirmed, the type of data reportedly taken in this incident, patient medical records and other sensitive information, could expose affected individuals to a range of downstream harms. Medical record theft can enable insurance fraud, where a criminal uses stolen information to obtain medical services or prescriptions in someone else’s name, potentially corrupting that person’s own medical history in the process. Exposed personal information can also fuel convincing phishing attempts, since scammers armed with real details about a person’s healthcare provider or treatment history can craft messages that appear far more legitimate than a generic scam email.
The notification timeline for incidents like this varies considerably depending on the state, the type of data involved, and how quickly a company can determine which individuals were actually affected. Federal and state breach notification laws generally require companies to notify affected individuals within a defined window once a breach is confirmed and its scope understood, but that process can take considerably longer when an investigation involves reconstructing exactly what data left the network and matching it to specific patients or employees across numerous locations.
Home health and hospice management companies present a particularly attractive target for ransomware groups because a single successful intrusion can potentially expose records spanning dozens of individual care locations at once. Unlike a typical retailer or service business, a company in this position often holds not just names and contact information but detailed clinical histories, prescription records, diagnosis codes, and insurance identifiers, all of which can be bundled and sold to criminals looking to commit large-scale insurance or medical identity fraud. The interconnected nature of these management structures, where one back-office system may service providers across multiple states, means a breach at the management level can ripple outward to affect patients who may never have interacted directly with the parent company at all.
Ransomware groups like the one that has claimed responsibility here typically operate on a double-extortion model, first encrypting a victim’s internal systems to disrupt operations and then threatening to publish or sell stolen data separately if a ransom is not paid. Even when a company declines to negotiate, the underlying data theft can already be complete by the time the attack becomes public, meaning the exposure itself may have occurred well before any dark web posting or news report brings it to light. This dynamic is part of why security researchers and affected individuals alike frequently learn of an alleged breach through a hacker group’s own claims rather than a company’s official statement.
Attorneys working with ClassAction.org are looking into whether current and former AngMar employees, along with patients and staff of the home healthcare providers AngMar manages, may have grounds to pursue a class action lawsuit over this alleged breach. This page will be updated as more information about the scope and nature of the incident becomes available.
When Did This Breach Occur?
The alleged breach came to light through an August 11, 2026 post on a dark web ransomware monitoring site, in which the hacker group Interlock claimed responsibility for the attack on AngMar. The exact date the intrusion itself occurred has not been publicly disclosed by AngMar. Companies often discover that a breach happened well before it becomes public, since forensic investigations into exactly when unauthorized access began can take considerable time to complete after suspicious activity is first detected.
What Information Was Breached?
According to the hacker group’s claims, approximately 710 gigabytes of data were taken from AngMar’s systems, reportedly including patient medical records and other confidential information. AngMar has not yet published a specific list of the data types involved, and it is not uncommon for a full breakdown, such as which combinations of Social Security numbers, medical record numbers, or other identifiers were included, to remain unavailable until a company completes its forensic review and issues formal notifications to those affected.
What You Can Do
If you are a current or former AngMar employee, or a patient or staff member of a home healthcare or hospice provider managed by AngMar, there are steps you can take while this investigation continues:
- Watch your financial accounts, medical bills, and insurance statements closely for unfamiliar activity.
- Request a copy of your medical records or an explanation of benefits from your health insurer to check for services you did not receive.
- Be cautious of unsolicited calls, texts, or emails referencing AngMar or your healthcare provider, especially ones asking you to confirm personal details.
- Consider placing a fraud alert or credit freeze with the major credit bureaus if you receive an official breach notification.
- Keep any notice you receive from AngMar, as it can serve as documentation if you later decide to pursue legal action.
File a Data Breach Lawsuit Against AngMar
If you believe your information was exposed as a result of this alleged AngMar data breach, you may have legal options. Companies that store sensitive medical and personal information are expected to maintain reasonable safeguards to prevent unauthorized access, and when those safeguards fail, the people affected can be left to deal with the fallout largely on their own.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
