The Suvida Healthcare 2026 data breach was a security incident affecting personal and health information that, according to the Texas-based primary-care provider's regulatory record, occurred from June 16 through June 17, 2026. The Texas Attorney General entry shows that the organization discovered the incident on June 17 and reported it as a healthcare provider.
Current Texas Attorney General record BR-0005183 reports that 3,597 people across the United States were affected, including 3,189 Texas residents. The confirmed data categories are names, addresses, dates of birth, medical information, health-insurance information, and an “other” category whose specific contents were not defined.
How Was the Suvida Healthcare Breach Confirmed?
The primary source is Texas Attorney General data security breach record BR-0005183. It publishes the Suvida Healthcare, LLC name, Austin address, incident and discovery dates, entity type, affected information categories, Texas subset, and nationwide total together. Those matching fields distinguish the event from similarly named healthcare organizations and notices involving different time periods.
The second source is Claim Depot's incident page, published July 14, 2026 and updated July 22. It independently matches the Suvida Healthcare domain and healthcare-provider identity to the Texas Attorney General disclosure, 3,189 Texas residents, and the same information categories. It also expressly records that an earlier figure of 2,109 Texas residents was later increased to 3,189.
What Happened on June 16-17, 2026?
The official record says the breach period began June 16 and ended June 17, 2026, when the incident was also discovered. Beyond those dates, public sources do not explain how an actor entered the environment, which system was involved, the precise duration of any access, or whether the information was viewed, copied, or transferred outside the organization.
The event therefore cannot responsibly be classified as ransomware, phishing, stolen credentials, a configuration error, malicious insider activity, or exploitation of a particular software flaw. The records confirm a data breach and identify affected information categories, but the technical root cause was not published. They also do not confirm an actor's identity, a ransom demand, or publication of the information online.
What Information Was Affected?
The Texas record lists names, physical addresses, dates of birth, medical information, and health-insurance information. It also includes an “other” category that the public entry does not define. The list does not establish that every field applied to every person; recipient-specific scope can be confirmed only through information provided directly by Suvida Healthcare.
Medical and insurance data can support fraudulent healthcare claims, false billing, misuse of insurance membership, and convincing healthcare-themed scams. The official record does not separately list Social Security numbers, driver's licenses, passports, bank accounts, payment cards, email passwords, or online-account credentials as confirmed categories, so the event's scope should not be expanded to include them without further evidence.
How Many People Were Affected?
BR-0005183 gives an exact nationwide total of 3,597 people and a Texas subset of 3,189. The Texas figure is included within the nationwide population and is not added again. The official portal entry appears as published on July 17, 2026, and its incident dates and organization details align with the disclosure that Claim Depot links to the same event.
Claim Depot says the reported Texas population changed from 2,109 to 3,189, while another part of its page characterizes the nationwide total as undisclosed. That is a freshness mismatch between fields captured at different times. Because the current Texas Attorney General record now explicitly publishes the nationwide total of 3,597, the official and more recent field controls for the total count.
How Did Suvida Healthcare Respond?
The Texas portal confirms discovery on June 17 and later publication of the attorney-general record. The same entry marks the field asking whether breach notice was provided to consumers as “No” and does not identify a notification method. Public sources provide no verifiable detail about a forensic investigation, law-enforcement notice, password reset, system change, or offer of credit monitoring.
Claim Depot advises people who received care from Suvida Healthcare and are concerned that their information may have been involved to contact the organization directly for scope and response details. That advice does not establish that the company mailed every person or offered a particular protection service. No recipient-specific letter, support line, or enrollment deadline was confirmed in the public sources reviewed.
What Should Affected People Do?
People who received care from Suvida Healthcare can review patient portals, health-insurance explanations of benefits, and service histories for an unfamiliar transaction, provider, or claim. If a suspicious medical or insurance entry appears, contact the organization and insurer through a known channel on a membership card or official website rather than an advertisement in search results or an inbound message.
An unexpected message containing a real name, address, birth date, or healthcare context is not automatically legitimate. Do not disclose a password, insurance member number, one-time code, or payment detail, and independently verify the sender before following a link. Report suspected identity misuse through IdentityTheft.gov and any false healthcare claim promptly to the relevant insurer and healthcare provider.
