HealthConsent
Active breach tracker Vancouver, WA Disclosed February 26, 2026

Evergreen Healthcare Group / Couve Healthcare Consulting Data Breach 2026 (Medusa Ransomware): 11,795 LTC Residents Exposed. Class Actions Filed. What To Do

Couve Healthcare Consulting, operating as Evergreen Healthcare Group, a Vancouver, WA management services organization for 50+ senior care communities across 7 states, disclosed in February 2026 a December 2025 Medusa ransomware attack. Approximately 143 GB exfiltrated. 11,795 affected. Two federal class actions filed in W.D. Washington. 12-24 months Cyberscout monitoring offered. Here is what to do.

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated Sources & methodology

Timeline

Dec 3, 2025

Unauthorized activity discovered in EHG cloud-based healthcare platform

Dec 3, 2025

Attacker gained access

Feb 13, 2026

Affected-individual list finalized

Feb 24, 2026

Direct notification letters mailed (USPS First Class)

Feb 25, 2026

Substitute notice published

Feb 26, 2026

Filed with HHS OCR; CA + MA AG filings

Data exposed

01

High-risk identity

Enables financial + identity theft

Social Security number Date of birth

03

Contact & insurance

Phishing + targeted scams

Full name Medical information

Class actions filed by

These firms have publicly announced investigations. You may be eligible to join. We are not a law firm and cannot give legal advice.

Federal class action filed: Terronez v. Couve, 3:26-cv-05213 (W.D. Wash.) Federal class action filed: Ross v. Couve, 3:26-cv-05210 (W.D. Wash.) Federman & Sherwood (publicly investigating) Strauss Borrelli (publicly investigating) Migliaccio & Rathod (publicly investigating) Shamis & Gentile (publicly investigating)
If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

01

Accept credit monitoring

It’s the floor of the response. Take it.

02

Freeze your credit

Free at Equifax, Experian, TransUnion.

03

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

04

Review your EOBs

Insurance statements catch medical identity theft early.

05

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

What happened

Couve Healthcare Consulting, LLC (operating as Evergreen Healthcare Group or “EHG”) is a Vancouver, Washington-based management services organization providing administrative, operational, and consulting services to skilled nursing, assisted-living, memory-care, rehabilitation, and respite communities. EHG operates a network of 50+ senior-care communities across 7 states. EHG is not a direct healthcare provider — it is the management/consulting back-office for SNF and AL operators.

On December 3, 2025, EHG discovered unauthorized activity inside its cloud-based healthcare platform. The forensic investigation confirmed file access. The affected-individual list was finalized on February 13, 2026. Direct notification letters were mailed via USPS First Class on February 24, 2026, the substitute notice was published February 25, and HHS OCR and state AG filings followed on February 26, 2026 — confirming 11,795 affected individuals (at least 2 Massachusetts residents per MA OCABR filing).

The Medusa ransomware group claimed responsibility on its leak site and asserted approximately 143 GB of exfiltrated data. The EHG notice does not explicitly attribute the attack.

Reporting notes affected current and former residents of the Golden Sonora Care Center specifically.

What was stolen

  • Full name
  • Social Security number
  • Date of birth
  • Medical information

The exposed data set is narrower than many similar breaches — payment card and insurance credentials are reportedly not in scope per the EHG notice.

What EHG is offering

  • Complimentary credit monitoring + identity-theft restoration via Cyberscout (TransUnion)
  • Duration: 12 months per HIPAA Journal; 24 months per some secondary trackers — the sample notice does not state duration definitively
  • Call center: 855-522-1474

Class action status

Two federal class actions have already been filed in the US District Court for the Western District of Washington (Tacoma Division):

  • Terronez v. Couve Healthcare Consulting, LLC — 3:26-cv-05213
  • Ross v. Couve Healthcare Consulting d/b/a Evergreen Healthcare Group — 3:26-cv-05210

Plus pre-suit investigations from Federman & Sherwood, Strauss Borrelli, Migliaccio & Rathod, and Shamis & Gentile.

What to do

  1. Enroll in Cyberscout through the activation code in your letter.
  2. Place free credit freezes at Equifax, Experian, and TransUnion. SSN exposure makes this essential.
  3. File IRS Form 14039.
  4. If you are a senior-care resident or family member, monitor Medicare Summary Notices for unauthorized claims.
  5. Stop the ongoing flow of your senior-care data. HealthConsent files HIPAA restriction requests so the demographic and medical data exposed in this breach is not continuously re-shared.

Continue reading

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.