Elevate Health and Rehabilitation, a skilled nursing and rehabilitation facility, began notifying residents in 2026 that personal and health information may have been exposed after two of its trusted third-party vendors were compromised. Long-term care facilities routinely rely on outside vendors to manage records, billing, and other administrative functions, and an incident at any one of those vendors can expose resident information even when the facility’s own systems were never directly breached.
Elevate Health & Rehabilitation’s Data Breach Investigation
According to the notification letter, Elevate discovered on June 1, 2026 that records maintained by a trusted vendor, some containing personal information about Elevate residents, had been accessed and copied by an unauthorized person. The facility’s investigation found that the unauthorized actor had logged into the vendor’s systems using credentials stolen from another trusted vendor, with the access window running from November 25, 2025 to November 28, 2025. Elevate states it took prompt action to disable the compromised credentials, reset passwords, engaged a specialized cybersecurity firm, and contacted the FBI.
Elevate further states that its investigation, while ongoing, found no evidence the unauthorized actor still has access to resident data or the vendor’s systems, and that it obtained credible evidence the actor did not publish the data and has permanently deleted the files that were taken. This kind of vendor-credential compromise, where an attacker uses stolen login information from one vendor to reach a second vendor’s systems, is an increasingly common attack pattern because it lets bad actors bypass a company’s own direct defenses entirely.
Healthcare and long-term care providers are frequent targets for this type of incident because the data they and their vendors hold, combining identity information with detailed medical and financial records, is especially valuable on the black market and can enable both financial fraud and medical identity theft. The roughly six-month gap between the reported access window and Elevate’s discovery of the incident also illustrates a common challenge in these cases: unauthorized access to a vendor’s systems is not always detected until the vendor or another party identifies unusual activity and alerts the affected organizations.
When Did This Breach Occur?
Unauthorized access reportedly occurred between November 25, 2025 and November 28, 2025. Elevate says it was first alerted to the issue on June 1, 2026, and notification letters to affected individuals followed in 2026.
What Information Was Breached?
According to the notice, information that may have been involved includes residents’ names, dates of birth, home addresses, email addresses, driver’s license numbers, and Social Security numbers. Health information that may have been compromised includes data related to resident care, such as diagnoses, lab results, medications, treatment information, and patient account numbers.
What You Can Do
Elevate is offering affected individuals identity theft protection services through IDX, including two years of credit and CyberScan monitoring and a $1,000,000 insurance reimbursement policy. Individuals who received a notice should also consider taking these additional steps:
- Enroll in the free IDX identity protection services before the October 31, 2026 deadline
- Review credit reports and account statements regularly for unfamiliar activity
- Place a fraud alert or security freeze with Equifax, Experian, and TransUnion
- Request a free annual credit report at annualcreditreport.com
- Report any suspected identity theft to local law enforcement or your state Attorney General
File a Data Breach Lawsuit Against Elevate Health & Rehabilitation
If you received a notice from Elevate Health & Rehabilitation about this security incident, you may have legal options available to you. Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
