Three Oaks Hospice, Inc. says an intruder had access to parts of its email environment, and the number of people affected is listed at 36,622. Sensitive health and identity details may be involved.
Three Oaks Hospice’s Data Breach Investigation
Three Oaks Hospice, Inc. is a Dallas, Texas company that provides hospice care, primary care and palliative care. It operates alongside sister organizations including Agape Hospice Care, Elevation Hospice of Colorado, Elevation Hospice of Utah and Sage Hospice, with locations in Arizona, Colorado, Georgia, Illinois, Kansas, Missouri, Pennsylvania, South Carolina and Texas. Because that footprint is so wide, a single email incident at the parent level can reach patients and families in many different states.
According to a notice the company published on September 17, 2026, it first noticed unauthorized activity connected to its email environment on August 8, 2025. The company says it moved quickly to investigate, contain and clean up the problem. What stands out is the length of the review that followed. It was not until July 20, 2026, roughly eleven months after the discovery, that the company concluded the activity had affected personal information held in those email accounts.
After reaching that conclusion, Three Oaks Hospice told its affected affiliated hospices on August 17, 2026. Notice to the individual patients and others whose details were involved followed starting around September 17, 2026. The company states that it has no knowledge of any actual or attempted misuse of the information. It also says it set up a dedicated toll-free call center, open weekdays during business hours Central Time, for people who have questions about whether they are affected.
The listing on the U.S. Department of Health and Human Services Office for Civil Rights breach portal places the number of affected individuals at 36,622. Separately, individual Three Oaks Hospice locations in Texas filed their own reports with the Texas Attorney General in the days around the notice, each covering the Texas residents tied to that location. That is a common pattern when a business with several affiliated entities experiences one incident, and it is the reason different public sources can show different totals for what is really the same event.
Email systems are an attractive target for attackers because they quietly collect years of sensitive material. In a hospice setting, staff routinely email referral paperwork, insurance verification, eligibility documents and care coordination details. Even when a company never intends email to be a long-term records system, old messages and attachments can pile up in a mailbox and become a rich source of personal data if someone gets in. That is why healthcare organizations are expected to limit what is retained in email and to protect accounts with strong access controls.
The company has not publicly explained how the intruder got into the email accounts, how many accounts were involved, or whether any files were confirmed to have been downloaded rather than only viewed. It also has not said what specific steps it has taken to prevent a repeat. Those are fair questions for anyone who received a letter, because the answers affect how much risk a person should assume.
The timeline raises a further concern for patients. Where unauthorized access starts in August 2025 and the affected parties are only told in the fall of 2026, a long stretch passes in which personal data may sit in the wrong hands without its owners knowing. Fraudsters do not always use stolen details right away. Information tied to Social Security numbers and health insurance can be held for months and then used to open accounts, file false tax returns or bill for medical services that were never provided.
Hospice patients and their families can be especially exposed. Many are older adults, and records may include details about family members or people who handled financial matters on a patient’s behalf. If you or a loved one received care from any Three Oaks Hospice location or one of its sister organizations, it is worth reading any letter you received carefully and keeping a copy. The sections below explain when the incident happened, what information may have been involved, and what steps you can take now.
When Did This Breach Occur?
Three Oaks Hospice says it discovered unauthorized activity in its email environment on August 8, 2025. It determined on July 20, 2026 that personal information had been affected, notified its affected affiliated hospices on August 17, 2026, and published a notice of the incident on September 17, 2026, when notification of individuals was under way.
What Information Was Breached?
The company says the information potentially involved may include names, dates of birth, driver’s license numbers, Social Security numbers, medical information and health insurance information. Not every type of information was present for every person, so the details in your own notice letter are the best guide to what applies to you.
What You Can Do
If you received a notice or believe you were a patient of a Three Oaks Hospice location, consider these steps:
- Read your notice letter closely and note which types of information it says were involved.
- Review explanation of benefits statements and insurer messages for services you did not receive, and report anything unfamiliar to your insurer.
- Check your credit reports for free at annualcreditreport.com, and consider a fraud alert or credit freeze with Equifax, Experian and TransUnion.
- Take up any credit monitoring or identity protection offered in your letter, and watch for unexpected tax filings or account openings.
- Be cautious with calls, texts or emails that mention your care or insurance, and report suspected identity theft to the Federal Trade Commission.
File a Data Breach Lawsuit Against Three Oaks Hospice
If you were notified of the Three Oaks Hospice data breach, or you believe your Social Security number, medical information or health insurance details were exposed, you may have legal options. Healthcare providers are expected to protect patient information and to tell people promptly when it is compromised, and a lawsuit can help hold a company accountable when it falls short.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
