860PalmFlex Inc Data Breach — Official Case File

From the AG filing description

860PalmFlex Inc operates as a specialized wellness, physical rehabilitation, and ergonomic solutions enterprise, bridging corporate health programs and specialized clinical physical therapy. Because of the nature of its operations, the company collects, processes, and stores an extensive volume of deeply sensitive information. This includes comprehensive intake records, physical therapy notes, functional capacity evaluations, health insurance details, dates of birth, and government-issued identification numbers for thousands of patients and corporate clients across the Midwest. Additionally, as an employer and service provider, 860PalmFlex Inc maintains sensitive internal personnel files, payroll records, and human resources data, making it a repository for high-value personal identifiable information. In 2026, 860PalmFlex Inc formally reported a data security incident to the Indiana Attorney General, triggering mandatory state notification procedures. While the precise mechanics of the breach are still under investigation, incidents impacting wellness and healthcare-adjacent organizations typically involve sophisticated cyberattacks, unauthorized intrusions into legacy databases, ransomware deployments, or third-party vendor compromises. These threat vectors often exploit vulnerabilities in digital infrastructure, allowing cybercriminals to bypass perimeter defenses and dwell undetected within internal networks for extended periods before exfiltrating massive repositories of confidential files. The exposure resulting from the 860PalmFlex Inc security incident encompasses a dangerous combination of sensitive records, including full names, dates of birth, Social Security numbers, health insurance policy IDs, and clinical treatment documentation. The compromise of this specific data creates severe, long-term risks for affected individuals. Expose a Social Security number and date of birth, and bad actors can easily open fraudulent credit lines, secure unauthorized loans, or commit comprehensive identity theft. When combined with health insurance and clinical treatment details, victims face unique threats such as medical identity theft, where fraudsters utilize compromised insurance details to obtain medical services, potentially corrupting the victim's permanent medical history and healthcare records. As an entity handling protected health information and sensitive consumer data, 860PalmFlex Inc was bound by stringent legal obligations under federal and state law, including the Health Insurance Portability and Accountability Act (HIPAA) and the Indiana Disclosure of Security Breach Law. These statutory frameworks mandate the implementation of robust administrative, physical, and technical safeguards—such as multi-factor authentication, end-to-end data encryption, regular vulnerability assessments, and strict access controls—to prevent unauthorized data exfiltration. The occurrence of a widespread data breach strongly suggests that 860PalmFlex Inc may have failed to maintain these required security standards, leaving confidential files vulnerable to exploitation. For Indiana residents who have received a data breach notification letter from 860PalmFlex Inc, this correspondence serves as formal legal acknowledgment that your private information was compromised due to corporate negligence. Under modern data privacy jurisprudence, the receipt of such a notice establishes legal standing to pursue a class action lawsuit seeking accountability, restitution, and enhanced cybersecurity monitoring. Crucially, victims are not required to demonstrate immediate financial loss or out-of-pocket expenses to join the litigation. Our firm investigates these matters on a strict contingency fee basis, meaning you pay zero legal fees or out-of-pocket costs unless we successfully recover compensation on your behalf.