What Happened?
On September 19, 2025, TMG Health, Inc., a company contracted to provide call center services to VillageCare, discovered that an unauthorized individual had gained access to its systems. Upon detection, TMG Health terminated the individual’s access, notified VillageCare of the incident, secured the affected systems, and launched an investigation with the assistance of internal resources to determine the nature and scope of the incident. The investigation determined that an unauthorized individual had access to personal and protected health information entrusted to VillageCare and stored within TMG Health’s information system from November 20, 2024, to September 19, 2025.
On or about November 14, 2025, VillageCare identified individuals whose sensitive personal and protected health information was included in the impacted data. On January 13, 2026, VillageCare filed a notice with the Attorney General of Massachusetts, posted a public notice to its website, and began sending notice letters to impacted individuals.