Northeast Professional Caregivers, a Jackson Township, Ohio-based provider of personal care and homemaking services, has notified current and prospective patients that an unauthorized party gained access to a company email account containing their personal information. The company reported the incident to the U.S. Department of Health and Human Services and says it has taken steps to secure its systems following the discovery.
Home healthcare and personal care providers routinely collect sensitive contact information, and in some cases health-related details, from the people they serve or who inquire about their services. Companies that gather this kind of information have a responsibility to protect it from unauthorized access, and a failure to do so can leave affected individuals vulnerable to follow-on scams and identity theft.
Northeast Professional Caregivers’s Data Breach Investigation
According to a company news release and local news reporting, Northeast Professional Caregivers discovered on April 23, 2026, that an unauthorized individual had accessed an employee email account. The compromised account reportedly contained a marketing list with personal details belonging to current and prospective patients who had received or inquired about the company’s home healthcare and homemaking services. Northeast Professional Caregivers, which operates in several counties in northeast Ohio, stated that the accessed information included names, addresses, phone numbers, and the types of services patients had sought, but did not include Social Security numbers, financial account information, or clinical medical records.
The company’s CEO stated publicly that there is no evidence the accessed information was misused or distributed as a result of the incident. Northeast Professional Caregivers said it launched an internal investigation with the assistance of outside cybersecurity experts, implemented two-factor authentication on its email systems, and notified the Department of Health and Human Services’ Office for Civil Rights in compliance with federal breach-notification requirements that apply to companies handling certain health-related information.
Business email compromise incidents like this one are among the most common ways personal information is exposed in the healthcare and home-care sector. Employee email accounts often serve as a central hub for scheduling, intake, and marketing communications, which means a single compromised inbox can expose contact information for a large number of current and prospective clients at once. Attackers who gain access to this kind of account can use it not only to view existing messages, but potentially to monitor future correspondence or send convincing phishing messages that appear to come from a trusted provider.
Even when a breach does not involve Social Security numbers or financial account details, the combination of a person’s full name, home address, phone number, and the specific type of care they were seeking can still be misused. Fraudsters frequently use exactly this kind of information to craft targeted phishing calls, texts, or emails that reference a person’s real circumstances, making the scam more convincing than a generic solicitation. This is especially true in the home healthcare context, where scammers may impersonate a caregiver, insurer, or government health program to try to extract additional sensitive information or payment.
Companies covered by federal health-privacy rules are generally required to notify affected individuals and, when a breach affects 500 or more people, to notify HHS without unreasonable delay. Northeast Professional Caregivers appears to have followed this notification framework, and the timeline between the April 2026 discovery and the company’s public statement is broadly consistent with the notice periods commonly seen in similar incidents. That does not eliminate the risk to affected individuals in the meantime, however, since notification alone does not undo any exposure that already occurred.
Small and mid-sized healthcare providers, including home-care and personal-care agencies, are frequently targeted by cybercriminals precisely because they may have fewer dedicated cybersecurity resources than larger hospital systems, while still maintaining valuable personal and health-adjacent information on thousands of current and prospective clients. Business email compromise, in particular, has become one of the most common attack vectors across the healthcare sector generally, since a single stolen employee password or successful phishing attempt can grant broad access to years of accumulated client correspondence and marketing lists. Regulators have increasingly emphasized that covered entities and their vendors must maintain reasonable administrative and technical safeguards, such as multi-factor authentication, precisely because attacks of this kind remain so common.
The steps Northeast Professional Caregivers describes taking after discovering the incident, including engaging outside cybersecurity experts and implementing two-factor authentication, are consistent with the kind of remediation typically recommended following a business email compromise. Even with these measures in place going forward, individuals whose information was already exposed before the account was secured cannot undo that exposure, which is why federal and state breach-notification laws generally require companies to inform affected individuals so they can take their own protective steps rather than relying solely on the company’s after-the-fact remediation.
When Did This Breach Occur?
Northeast Professional Caregivers has stated that it discovered the unauthorized access to a company email account on April 23, 2026. The company issued a public notice and news release about the incident by late June 2026, and it reported the breach to the U.S. Department of Health and Human Services’ Office for Civil Rights as required for incidents affecting a substantial number of individuals. As is common with breach investigations, there may be a gap between when unauthorized access first began and when it was actually detected, since forensic investigations often take time to establish a full timeline.
What Information Was Breached?
Northeast Professional Caregivers has stated that the compromised email account contained a marketing list with personal information belonging to current and prospective patients. The specific data elements identified include names, home addresses, phone numbers, dates of birth, and the type of home healthcare or homemaking services a person sought or inquired about. The company has said that Social Security numbers, financial account information, and clinical medical records were not part of the exposed data set, and that it has no evidence the information was misused or distributed.
What You Can Do
If you received a notice from Northeast Professional Caregivers, or believe you may have been affected by this incident, consider taking the following steps:
- Monitor your credit reports and financial accounts for any unfamiliar activity, even though this incident reportedly did not expose financial account numbers.
- Be cautious of unexpected calls, texts, or emails referencing your interest in home healthcare services, since scammers sometimes use breached contact information to craft convincing phishing attempts.
- Consider placing a fraud alert or credit freeze with the major credit bureaus if you have concerns about identity theft.
- Keep any breach notification letter or communication from Northeast Professional Caregivers, as it may be useful if you decide to pursue legal options.
- Report any suspicious activity you notice to Northeast Professional Caregivers directly and to the appropriate state or federal authorities.
File a Data Breach Lawsuit Against Northeast Professional Caregivers
If you were notified that your personal information may have been exposed in the Northeast Professional Caregivers data breach, you may have legal options available to you. Companies that collect personal and health-related information are expected to implement reasonable safeguards to protect it, and a failure to do so can form the basis of a legal claim on behalf of those affected.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
