OPTION CARE HEALTH, INC. Data Breach — Official Case File

From the AG filing description

Option Care Health, Inc. operates as a major provider of home and alternate-site infusion services in the United States, providing critical clinical care and specialized pharmaceutical treatments directly to patients with complex and chronic conditions. Because of the essential nature of its operations, the company routinely collects, processes, and maintains vast repositories of highly sensitive patient health records, clinical histories, billing details, and personal identification data. This heavy reliance on digital health platforms and electronic health records makes the organization a centralized repository of confidential information, requiring rigorous administrative, physical, and technical safeguards to protect patient privacy against persistent cyber threats. In 2025, Option Care Health, Inc. formally reported a significant data security incident to the Illinois Attorney General, signaling that unauthorized actors may have gained access to its network infrastructure or third-party vendor systems. In the healthcare sector, incidents of this nature frequently involve sophisticated cyberattacks such as unauthorized database intrusions, ransomware deployments, or credential compromises targeting administrative or clinical environments. When healthcare networks are breached, threat actors often exploit vulnerabilities in digital architecture to covertly exfiltrate sensitive files before organizations detect and contain the unauthorized activity. The exposure resulting from the Option Care Health, Inc. incident places affected individuals at a severe, long-term risk of identity theft, medical fraud, and financial exploitation. Compromised data elements typically encompass full names, dates of birth, Social Security numbers, health insurance details, prescription histories, and sensitive clinical diagnosis records. Unlike standard consumer data breaches, the compromise of protected health information creates unique dangers, such as fraudulent medical billings, unauthorized prescription refills under a victim's name, or interference with ongoing medical care, leaving victims vulnerable to exploitation for years after the initial incident. Under federal and state law, including the Health Insurance Portability and Accountability Act (HIPAA) and the Illinois Personal Information Protection Act, healthcare organizations like Option Care Health, Inc. maintain a strict legal duty to implement and maintain comprehensive data security measures to protect sensitive patient records. The occurrence of a widespread data breach strongly indicates a failure to adequately secure network boundaries, monitor for unauthorized access, or maintain proper administrative safeguards. Under these statutory frameworks, covered entities are required to notify victims promptly and ensure that personal and health information is safeguarded against foreseeable digital threats. Receiving an official data breach notification letter from Option Care Health, Inc. serves as formal legal confirmation that your confidential records were compromised as a result of the company's security failure. Under modern class action jurisprudence, the receipt of this notice establishes the legal standing necessary to participate in litigation and pursue accountability. Affected individuals are not required to demonstrate actual financial loss or identity theft to seek legal redress; the increased risk of future harm is sufficient. Our firm evaluates these cases on a strict contingency fee basis, meaning you pay nothing out of pocket and owe no fees unless we successfully recover compensation on your behalf.