FlexCare, LLC data breach

What we know

FlexCare, LLC operates as a healthcare-related enterprise, delivering specialized patient care coordination, medical staffing, and administrative health support services. Because of the critical nature of its operations, the organization routinely collects, processes, and maintains vast repositories of confidential patient and employee information. This sensitive data environment is essential for managing health plan enrollment, coordinating specialized medical treatments, and maintaining compliance with complex healthcare regulations, making the company a central repository for highly sensitive personal and medical records.

In 2025, FlexCare, LLC reported a significant data security incident to the Office of the Maryland Attorney General. While the precise technical vector continues to be evaluated, incidents affecting organizations of this scale typically involve unauthorized access to internal databases, compromise of enterprise network infrastructure, or vulnerabilities within third-party vendor systems used for patient management and operational workflows. Threat actors frequently target healthcare and care coordination providers to exploit outdated security protocols, deploy ransomware, or exfiltrate valuable protected health information.

Based on the typical scope of incidents within the healthcare and medical support sector, the breach compromised a wide array of sensitive information, including full names, dates of birth, Social Security numbers, medical record numbers, health insurance policy details, and clinical diagnosis or treatment histories. The exposure of this combination of personal and protected health information creates severe, long-term risks for affected individuals. Unlike standard financial breaches where credit cards can be canceled, medical data cannot be altered. Exposed medical records can be leveraged for medical identity theft, enabling unauthorized individuals to obtain prescription drugs, receive medical treatments, or bill insurance providers under another person's name, leaving victims with compromised medical histories and devastating financial liabilities.

As an entity handling protected health information and sensitive consumer data, FlexCare, LLC was bound by stringent federal and state regulatory frameworks, most notably the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, and applicable Maryland data privacy statutes. These laws impose strict legal obligations to implement robust administrative, physical, and technical safeguards to secure electronic protected health information. The occurrence of a data breach of this magnitude serves as a strong indicator of potential systemic failures in maintaining adequate cybersecurity defenses and failing to adhere to mandatory data protection standards.

Receiving a data breach notification letter from FlexCare, LLC is a formal acknowledgment that your private information was compromised due to corporate security negligence. Legally, the receipt of this letter establishes the foundation for affected individuals to participate in legal action, providing the standing necessary to hold the company accountable. Under modern class action jurisprudence, victims are not required to demonstrate actual financial loss or identity theft to seek legal redress; the mere exposure of sensitive data resulting from a breach constitutes a compensable injury. Our firm evaluates these claims on a contingency fee basis, meaning you pay nothing out of pocket and owe no legal fees unless we successfully recover compensation on your behalf.

See every breach reported in Maryland or read what to do after a ransomware attack.