VITAS Hospice Services
Disclosed Nov 19, 202510 months ago319,177 affectedConfirmed
Compromised vendor account exposes 319,177 VITAS hospice patients
VITAS, the largest US for-profit hospice chain, said an attacker used a compromised vendor account to access its systems between September 21 and October 27, 2025 and view and download patient information; it identified the breach October 24.
What is known
| People affected | 319,177 (as reported to HHS) |
|---|---|
| Disclosed | Nov 19, 2025 |
| Discovered | Oct 24, 2025 |
| Happened | Sep 21, 2025 |
| Attack | Vendor breach |
| Data exposed | Names, Health, Other, Social Security numbers, Insurance, Dates of birth, Addresses |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: VITAS Hospice Servicesoag.ca.gov · Official notice | Official notice |
| HHS OCR breach report: VITAS Hospice Services (Healthcare Provider, FL)ocrportal.hhs.gov · Official notice | Official notice |
| November 2025 Healthcare Data Breach Reporthipaajournal.com · News | News |
| VITAS Hospice Services Discovers Month-Long Network Intrusion Affecting 319K Patientshipaajournal.com · News | News |
| Texas Attorney General data security breach report BR-0004683: VITAS Hospice Servicesoag.my.site.com · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Nov 19, 2025 | |
| Texas AGresidents of TX | Nov 21, 2025 | 5,633 |
| HHS OCRtotal | Nov 24, 2025 | 319,177 |
| Researchtotal | Nov 25, 2025 | 319,177 |
History of this record
- 2026-09-25 · data_types: ["names","health","other"] to ["names","health","other","ssn","insurance","dob","addresses"] · backfill source
- 2026-09-25 · attack: hacking to third-party · seed source
- 2026-09-25 · data_types: ["names","health"] to ["names","health","other"] · seed source
- 2026-09-25 · discovered: empty to 2025-10-24 · seed source
- 2026-09-25 · summary: empty to VITAS, the largest US for-profit hospice chain, said an attacker used a compromised vendor account to access its systems between September 21 and October 27, 2025 and view and download patient information; it identified the breach October 2 · seed source
- 2026-09-25 · title: empty to Compromised vendor account exposes 319,177 VITAS hospice patients · seed source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 319177 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.