Operation PAR, Inc., Boley Centers, Inc., and PEMHS dba Eleos data breach

What we know

Operation PAR, Inc., Boley Centers, Inc., and PEMHS dba Eleos operate within the behavioral health, substance abuse rehabilitation, and community mental health services sector. As organizations providing critical clinical care, psychiatric counseling, and social support services, they collect and maintain deeply sensitive information from vulnerable populations. This includes detailed intake forms, mental health assessments, medical histories, and administrative records necessary for coordinating ongoing therapeutic interventions and insurance billing. Because these entities manage comprehensive healthcare records alongside standard administrative and financial data, they represent high-value targets for malicious actors seeking to exploit confidential personal and medical information. In 2026, Operation PAR, Inc., Boley Centers, Inc., and PEMHS dba Eleos reported a significant data security incident to the New Hampshire Attorney General's Office. While specific forensic details surrounding the attack method continue to emerge, incidents of this nature typically involve unauthorized access to digital environments, sophisticated ransomware deployments, or third-party software vulnerabilities that compromise secure databases. Healthcare and behavioral health networks are particularly susceptible to intrusions due to the complex web of legacy systems, electronic health record platforms, and third-party vendors required to maintain continuous patient care operations. The data compromised during this security incident encompasses a broad spectrum of highly sensitive information, each category carrying distinct risks for affected individuals. Exposure of names, dates of birth, and Social Security numbers creates an immediate, long-term risk of identity theft and fraudulent credit inquiries. Furthermore, the potential exposure of medical record numbers, clinical diagnosis details, treatment histories, and health insurance information introduces severe risks of medical fraud, including unauthorized billing under a victim's insurance, compromised prescription histories, and the potential exposure of deeply private psychiatric or substance abuse treatment records. Unlike standard consumer data breaches, the compromise of behavioral health records strikes at the core of an individual's personal privacy and medical autonomy. As organizations handling protected health information, Operation PAR, Inc., Boley Centers, Inc., and PEMHS dba Eleos were bound by stringent legal obligations under the Health Insurance Portability and Accountability Act (HIPAA), as well as state consumer protection statutes. These regulations mandate the implementation of robust administrative, physical, and technical safeguards to secure electronic protected health information against foreseeable threats. The occurrence of a breach affecting such sensitive repositories strongly suggests potential failures in network monitoring, encryption protocols, access controls, or vendor risk management. Under the law, entities that collect and store private healthcare data have an affirmative duty to protect it from unauthorized disclosure. Receiving a formal data breach notification letter from Operation PAR, Inc., Boley Centers, Inc., and PEMHS dba Eleos is an official acknowledgment that your private information was compromised due to inadequate security measures. Under established legal principles, this notification provides affected individuals with the legal standing necessary to participate in a class action lawsuit aimed at holding these organizations accountable. Importantly, victims do not need to demonstrate actual financial loss or identity theft to seek legal recourse; the increased risk of future harm and the invasion of privacy are sufficient grounds for action. Our firm handles these complex data privacy cases on a contingency fee basis, meaning you pay no out-of-pocket costs and owe no attorney fees unless we successfully recover compensation on your behalf.

See every breach reported in New Hampshire or read what to do after a ransomware attack.