VillageCareMAX has reported a data breach resulting from unauthorized access to patient information by a third-party service provider. The breach exposed personal and protected health information of an undisclosed number of individuals over a 10-month period.
VillageCareMAX’s Data Breach Investigation
VillageCareMAX, a managed long-term care health plan provider, recently disclosed a data breach involving sensitive personal and health information. The breach was not the result of a direct attack on VillageCareMAX, but rather on TMG Health, Inc., a third-party administrator contracted to provide call center services for VillageCareMAX.
TMG discovered that between November 20, 2024, and September 19, 2025, an unauthorized individual had access to VillageCareMAX patient data stored on TMG’s systems. Upon discovery, TMG immediately revoked access, launched an internal investigation, and notified VillageCareMAX of the breach. The company also took steps to secure the compromised systems.
After receiving confirmation from TMG, VillageCareMAX reviewed the impacted data to identify affected individuals and determine the type of information exposed. That review revealed that a combination of personal identifiers and protected health information was compromised. Specifically, names, Social Security numbers, member identification numbers, and various health details may have been involved.
On January 13, 2026, VillageCareMAX began mailing data breach notifications to impacted individuals. Affected parties were offered complimentary credit monitoring services and additional support. VillageCareMAX emphasized that no financial information was involved, and there have been no confirmed reports of fraud or misuse.
This incident underscores the vulnerability of patient data, especially when entrusted to external vendors. Even when a healthcare provider’s internal systems remain secure, third-party service failures can leave patients exposed to serious privacy risks.
When Did This Breach Occur?
The breach occurred between November 20, 2024, and September 19, 2025. Notification letters were issued starting January 13, 2026.
What Information Was Breached?
Depending on the individual, the exposed data may have included:
No financial or payment card information was involved.
What You Can Do
If you or a family member received a data breach notification from VillageCareMAX:
-
Enroll in the free credit monitoring services offered to protect your identity.
-
Request your free annual credit reports at annualcreditreport.com or call 1-877-322-8228.
-
Review Explanation of Benefits (EOBs), Medicare, or Medicaid statements for unfamiliar services.
-
Place a fraud alert or credit freeze with major credit bureaus to prevent new accounts from being opened in your name.
-
Stay vigilant for identity theft or phishing scams that use health data to impersonate medical providers or insurers.
Even if you haven’t noticed fraudulent activity, the exposure of your personal and medical information puts you at long-term risk. Legal action may be an option if your data was mishandled.
File a Data Breach Lawsuit Against VillageCareMAX
If your personal or health data was exposed through VillageCareMAX’s third-party breach, you may be eligible to join a class action lawsuit. Health providers and their contractors are legally required to safeguard your protected health information. When they fail, individuals have the right to seek compensation.
Joining a class action lawsuit could help you recover damages for time lost, emotional distress, and the long-term impact of compromised data security. Class Action U is here to connect you with experienced attorneys who specialize in healthcare data breach cases.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
