Boston Health Care for the Homeless Program Data Breach Lawsuit Investigation
Received an August 2026 breach notice from Boston Health Care for the Homeless Program?
Dapeer Law, P.A. is investigating a potential class action against Boston Health Care for the Homeless Program, Inc., a Boston-based nonprofit provider of medical care to people experiencing homelessness, on behalf of the 185,467 patients whose personal and medical information may have been exposed in the November 2025 network intrusion.
Who may qualify
You may be eligible to participate in a class action if any of the following applies:
- You received a data breach notification letter from Boston Health Care for the Homeless Program dated August 2026.
- Your letter offered enrollment in 24 months of free Cyberscout credit monitoring (single-bureau), with a 90-day window to activate the enrollment code.
- You were a patient of Boston Health Care for the Homeless Program, or otherwise had personal, medical, or health insurance information held by the organization in its capacity as a HIPAA-covered health care provider.
- No proof of harm required to consult with counsel. You do not need to have already suffered identity theft to explore your legal options.
- Excluded: individuals who did not receive a breach notice and whose information was not involved in the incident.
Not sure if you qualify?
Send us your notice, we'll confirm your eligibility at no cost.
What happened
Boston Health Care for the Homeless Program identified a disruption to its computer network on November 11, 2025. The organization engaged independent cybersecurity experts, and the resulting forensic investigation confirmed that certain files on its systems had been accessed and, in some instances, copied from the network without authorization. The organization has not publicly identified the method of intrusion or the threat actor involved.
On June 8, 2026, roughly seven months after the disruption was identified, Boston Health Care for the Homeless Program determined that the affected files contained patient information. Formal notification letters were mailed on August 7, 2026, and the incident was reported to regulators in Massachusetts and Texas. Regulatory filings report 185,467 affected individuals, including 184,914 Massachusetts residents and 553 Texas residents. The notice states that the information involved may have included names, Social Security numbers, driver's license numbers, medical information, and health insurance information, and the organization is offering 24 months of complimentary single-bureau credit monitoring, credit reports, credit scores, and fraud assistance through Cyberscout, a TransUnion company.
The combination reported here is among the most sensitive in a data breach. A Social Security number paired with medical and health insurance details supports both financial identity theft and medical identity theft, in which a person's insurance is used to obtain treatment or prescriptions in their name. Unlike a payment card, a Social Security number cannot be reissued on request, and medical records cannot be recalled once copied. The patient population served by this organization may also face heightened difficulty detecting and correcting fraudulent activity. Dapeer Law is evaluating whether the organization's data security practices, and the roughly nine-month gap between the November 2025 intrusion and the August 2026 notice letters, give rise to claims under Massachusetts and Texas law.
What to do if you received a letter
Keep your notice letter
Do not discard it. Your letter contains the unique enrollment code for the free credit monitoring and is important evidence that you were among the 185,467 individuals identified in the regulatory filings if you decide to participate in a lawsuit.
Enroll in the free 24-month credit monitoring
Enroll in the Cyberscout (single-bureau) monitoring offered in your letter within the 90-day window stated in the notice. The package includes credit monitoring, credit reports, credit scores, and proactive fraud assistance. Accepting this benefit does not waive your right to pursue legal action.
Place a fraud alert or credit freeze
Contact Equifax, Experian, and TransUnion to place a fraud alert or freeze on your file. Request a free weekly credit report from AnnualCreditReport.com, and use the FTC's IdentityTheft.gov recovery guide. Because medical and health insurance information was reported as involved, also review Explanation of Benefits statements from your insurer for treatment, providers, or prescriptions you do not recognize, and request a copy of your medical file if anything looks unfamiliar.
Speak with a data breach attorney
Consultations with Dapeer Law are free and confidential. We will review your notice letter, explain how Massachusetts and Texas breach notification requirements and HIPAA-related standards apply to health care providers, and advise whether you may be eligible to join a class action.
Submit your notice for a free review
Two minutes online. A licensed attorney reviews every submission.
Breach timeline
Compensation you may be entitled to
Out-of-pocket expenses
Credit freezes, identity restoration services, and other costs incurred responding to the breach.
Time spent monitoring
Hours spent reviewing accounts, disputing fraudulent charges, and dealing with identity theft issues.
Identity theft & fraud losses
Unreimbursed funds stolen from accounts, unauthorized credit lines, medical-claim and health insurance fraud, or tax refund fraud tied to the breach.
Statutory damages
Certain state data breach and consumer protection statutes provide for fixed damages regardless of actual loss.
Injunctive relief
Court orders requiring Boston Health Care for the Homeless Program to implement stronger data security practices going forward, including improved network monitoring, encryption of stored patient records, and faster breach notification to affected patients.
Compensation categories depend on applicable state law, the types of data exposed, and documented losses. No recovery is guaranteed.
Common questions
I received a data breach letter from Boston Health Care for the Homeless Program. What should I do? +
Keep the letter, including the envelope and the enrollment code. Enroll in the 24 months of free Cyberscout credit monitoring within the 90-day window described in your notice. Review your credit reports and, because medical and health insurance information was reported as involved, review your Explanation of Benefits statements for treatment or prescriptions you do not recognize. Consider placing a fraud alert or a security freeze with Equifax, Experian, and TransUnion, which is free. Then speak with a data breach attorney about your options.
Am I eligible to join a class action against Boston Health Care for the Homeless Program? +
If you received a notice letter dated August 7, 2026 from Boston Health Care for the Homeless Program, you were among the 185,467 individuals identified in the regulatory filings and may be eligible. Most affected individuals are Massachusetts residents (184,914), with 553 Texas residents also notified. Eligibility and the value of a claim can depend on your state of residence, which categories of your information were involved, and whether you have documented losses, unauthorized charges, or time spent resolving fraud. A free consultation is the fastest way to find out where you stand.
How much money could I receive from a class action lawsuit? +
Data breach class action recoveries vary significantly. Settlements typically range from a few hundred dollars for basic out-of-pocket losses to several thousand dollars for documented identity theft, with class size, damages, and negotiation all affecting the final amount. No payout is guaranteed, and this investigation has not yet resulted in a settlement.
What personal information was exposed in the breach? +
According to the notification filed with state regulators, the information involved may have included names, Social Security numbers, driver's license numbers, medical information, and health insurance information. The categories that apply to you specifically should be described in your individual letter, so check it and keep it. Boston Health Care for the Homeless Program has not publicly disclosed how the intrusion occurred or whether the copied files have been posted or offered for sale.
Did Boston Health Care for the Homeless Program offer free credit monitoring? +
Yes. Boston Health Care for the Homeless Program is offering 24 months of complimentary single-bureau credit monitoring, credit reports, credit scores, and proactive fraud assistance through Cyberscout, a TransUnion company. Your letter contains a unique enrollment code and a 90-day window to activate it. Enrolling does not waive your right to pursue a legal claim, and it does not release the organization from liability.
How many people were affected by the Boston Health Care for the Homeless Program breach? +
State filings report 185,467 affected individuals: 184,914 Massachusetts residents and 553 Texas residents. That figure comes from the notifications filed with the Massachusetts and Texas Attorneys General on August 7, 2026. This page will be updated if the organization or a regulator revises the count.
Is there a deadline to take legal action? +
Yes. Statutes of limitations for data breach claims vary by state and legal theory, typically ranging from one to six years. Waiting can permanently bar your claim. Contact us as soon as possible for a free evaluation.
How do I get a copy of the official breach notice? +
The notice was filed with the Massachusetts Attorney General, where it is published as filing 2026-1319, and a copy of the notice letter is also posted by the California Attorney General's data breach notification database. Both are linked in the Sources and references section of this page. If you cannot locate your letter or need help obtaining a copy, Dapeer Law can assist during a free consultation.
Sources & references
- Official breach notice filing · Massachusetts Attorney General, Data Breach Notification 2026-1319 (PDF)
- Sample notice letter · California Attorney General, BHCHP breach notice letter (PDF)
- Company · Boston Health Care for the Homeless Program, Inc. (bhchp.org)
- Credit bureau freezes · Equifax · Experian · TransUnion
- Free weekly credit reports · AnnualCreditReport.com
- Identity theft recovery guide · FTC IdentityTheft.gov
Don't let the deadline decide for you. Submit your claim today.
You only have a limited window to act. Our team will review your notice, explain your options, and tell you whether you may be eligible to recover compensation, at no cost to you.
