NextStep Care, which is operated by Source Care Management, LLC, has reported a data breach affecting 685 people to the federal government.
Here is what is publicly known so far and what you can do if you may be affected.
Source Care Management, LLC d/b/a NextStep Care’s Data Breach Investigation
Source Care Management, LLC does business as NextStep Care, a Georgia provider of case-management services that help people navigate health and social services. In September 2026 the organization appeared on the federal breach portal run by the U.S. Department of Health and Human Services Office for Civil Rights, which lists breaches of protected health information that affect five hundred or more people.
According to that listing, the entity is based in Georgia and is classed as a healthcare provider. The listing was submitted on September 25, 2026 and reports that 685 individuals were affected. The type of breach is recorded as unauthorized access or disclosure, and the location of the breached information is recorded as paper or films, rather than as a computer system, email account or network server.
That last detail is unusual and worth pausing on. Most breaches reported to the federal portal in recent years involve hacking or network servers. A paper or films entry points to physical records, such as printed case files, forms or images, rather than a cyberattack on a database. The listing does not say how the records were accessed or disclosed, who obtained them, or whether they were lost, taken or sent to the wrong person.
The company has not, in the material reviewed for this page, published its own notice explaining what happened. This page therefore does not describe a cause, a timeline of the incident, or the specific categories of information involved, and it does not guess at them. Anything beyond the federal listing would be speculation, and readers deserve to know which facts are confirmed and which are not.
What the listing does tell us is the scale. A count of 685 people is small compared with the largest healthcare incidents, but it is still a meaningful number of real patients and clients, and under federal rules any breach at or above the five-hundred-person threshold must be reported to the government and to the individuals involved. Entities that cross that line are also required to notify affected people directly, normally by letter, so anyone who received services from NextStep Care and later receives a notice about a privacy incident should read it closely.
Case-management organizations often hold a wide range of sensitive material. To arrange care and benefits for someone, a case manager may need identifying details, contact information, health and disability information, insurance or benefit program details and notes about a person’s living situation. Which of those categories, if any, were involved here has not been publicly stated, and it would be wrong to assume that every category applies to every person.
Paper-based incidents can be harder for people to evaluate than electronic ones. With a hacking incident there is usually a defined window of time and a known set of systems. With physical records, the questions are different: where the records were kept, who could reach them, whether they were destroyed or moved, and whether anyone outside the organization read them. Until the organization explains, affected people are left to rely on whatever the letter they receive says.
If you have worked with NextStep Care or Source Care Management, the practical step is to watch your mail for a notice, keep it along with its envelope, and read it for the specific information involved and any protective services offered. Letters about a breach can look like junk mail, so do not throw away anything from the organization without reading it. If you are unsure whether a message is real, contact the organization using a phone number or address you already trust instead of one printed in an unexpected text or email.
People often assume that an exposure of paper records is less dangerous than one involving computers. That is not necessarily so. Printed documents can contain the same names, addresses, dates of birth, benefit details and Social Security numbers that appear in a digital file, and once a paper record leaves the control of the organization that created it, there is no practical way to track where it goes. For that reason the same precautions apply: review statements, check credit reports and be cautious about unexpected requests for information.
Because the public record is thin, this page may change as more information becomes available. If the organization posts a notice, files with a state attorney general or provides additional details to regulators, those documents will be the best source on what was involved, how many people received letters and what steps the organization has taken since the incident.
When Did This Breach Occur?
The federal breach portal lists the report as submitted on September 25, 2026. The dates on which the records were accessed or disclosed, and the date the organization first learned of the problem, have not been published.
Anyone who was notified should compare the dates in their own letter with what is stated here, since the organization’s notice may contain more detail than the federal listing.
What Information Was Breached?
The federal listing does not say which categories of personal information were involved. It records only that the breach was an unauthorized access or disclosure involving paper or films and that 685 individuals were affected.
The organization has not publicly disclosed the specific data types. The notice letter, if you receive one, is the best guide to what applies to you.
What You Can Do
If you received a notice related to NextStep Care or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Because the records at issue were paper-based, keep any letter you receive and note who sent it and when it arrived.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Source Care Management, LLC d/b/a NextStep Care
If your personal information was exposed in this incident, you may have legal options. Organizations are expected to protect the information they are trusted with, and a class action can help hold them accountable when security falls short.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
