Brightmoor Hospice, LLC is a hospice provider based in Griffin, Georgia. It has notified patients that two employee email accounts were accessed without authorization and that protected health information was present in them.
Here is what the company has disclosed, what remains unknown, and what you can do if you received a notice.
Brightmoor Hospice’s Data Breach Investigation
On October 16, 2026, Brightmoor Hospice, LLC announced that it was providing notification of a data security incident that may have affected certain protected health information. The company reported that it first noticed suspicious activity involving two employee email accounts on or around March 25, 2026.
After noticing the activity, Brightmoor said it secured the accounts and brought in third-party specialists to investigate. That investigation determined that the two employee email accounts were accessed without authorization between March 24, 2026 and March 25, 2026.
Once unauthorized access was confirmed, the company began a detailed review of what the affected accounts contained, to learn whether they held sensitive information about individuals. On August 18, 2026, Brightmoor determined that protected health information belonging to certain patients was present in the accounts. The company then reviewed its internal records to find mailing addresses for the people who might be affected.
Brightmoor began notifying individuals by mail on October 16, 2026. It also stated that it notified the U.S. Department of Health and Human Services Office for Civil Rights. The company said it has no evidence of actual or attempted misuse of the information, and it is offering complimentary credit monitoring to people who may have been affected. It has set up a toll-free call center to answer questions, and it said it is reviewing and adding security measures to strengthen the protection of its systems.
The company has not published a total number of people affected. Because the notice describes information as varying by individual, not every recipient will have had every type of data exposed. A person’s own letter is the best guide to what applies to them.
Email accounts are a common point of entry in healthcare incidents because staff routinely send and store patient details in messages and attachments. When a mailbox holds records like diagnoses, medication lists, insurance details and identity numbers together, it can give someone enough to attempt identity theft or medical identity theft. This is general context about the sector and is not a statement about how any information in this incident was used.
The timeline also shows how long these reviews can take. The unauthorized access occurred in March 2026, the company confirmed that patient health information was involved in August 2026, and letters began going out in October 2026. Anyone who received a letter should read it closely, keep it, and not assume that a lack of reported misuse means no precautions are needed.
When Did This Breach Occur?
Brightmoor reported that two employee email accounts were accessed without authorization between March 24, 2026 and March 25, 2026, and that it discovered suspicious activity on or around March 25, 2026.
The company determined on August 18, 2026 that protected health information was present in the accounts, and it began mailing notices on October 16, 2026.
What Information Was Breached?
According to the company, the information involved varies by individual and may include a name plus one or more of the following: addresses, Social Security numbers, driver’s license information, dates of birth, patient identification numbers, diagnosis, medical history information, medical record numbers, medical treatment information, lab information, a treating doctor’s name, medication information, vaccination information, medical insurance information, and family and social history information.
What You Can Do
If you received a notice from Brightmoor Hospice or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for the complimentary credit monitoring it offers.
- Review bank, card, and insurance statements and explanation of benefits forms for anything you do not recognize, and report errors promptly.
- Place a free fraud alert or a credit freeze with Equifax, Experian, and TransUnion, and get your reports free at annualcreditreport.com.
- Be skeptical of unexpected calls, texts, or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Brightmoor Hospice
If your personal or health information was exposed in this incident, you may have legal options. Healthcare providers are expected to protect sensitive patient data, and a class action can help hold them accountable when security falls short.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
