Data Breaches Announced by Open Arms Care; Elmwood Home Care
Data breaches have been announced by the Tennessee-based disability care provider Open Arms Care Corporation and the Rhode Island and Massachusetts home healthcare provider, Elmwood Home Care.
Open Arms Care, Tennessee
Open Arms Care Corporation, a Brentwood, TN-based nonprofit provider of residential and therapeutic care services to individuals with disabilities, has recently disclosed a breach of its email tenant. Suspicious activity was identified in August 2025, indicative of unauthorized access to an email account. The forensic investigation confirmed that the account had been accessed by an unauthorized third party between June 2025 and August 2025.
The account was reviewed to determine the individuals affected and the types of data involved, and that process was completed on April 30, 2026. Up-to-date contact information was obtained, and notification letters were mailed to the affected individuals on June 9, 2026. The types of data involved varied from individual to individual and may have included names in combination with one or more of the following: Medical diagnosis, treatment information, Social Security number, and/or health insurance information. The number of affected individuals has not been publicly disclosed at the time of writing.
Elmwood Home Care, Rhode Island/Massachusetts
Elmwood Home Care, a home healthcare provider serving patients in Rhode Island and Massachusetts, has recently announced a cybersecurity incident that resulted in unauthorized access to its computer systems between January 24, 2026, and February 13, 2026.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The forensic investigation determined that a threat group viewed or acquired files containing patient data such as names, dates of birth, Social Security numbers, driver’s license numbers, other demographic information, medical information, and health insurance information. Elmwood Home Care said it is reviewing its data security policies and procedures and is implementing additional administrative and technical safeguards to better protect its systems and sensitive data.
At the time of publication, the number of affected individuals had not been publicly disclosed. This appears to have been a ransomware attack, for which the LockBit5 ransomware group claimed responsibility.
