How do I know if I am affected by the Manhattan Retirement Foundation d/b/a Meadowlark Hills data breach?

Manhattan Retirement Foundation d/b/a Meadowlark Hills is mailing notification letters directly to affected individuals. If you have received care or services from Manhattan Retirement Foundation d/b/a Meadowlark Hills (also operating as Meadowlark Hills) in the period leading up to February 2026 and you have not received a letter, contact the entity directly. 14,442 individuals were confirmed affected in the HHS OCR filing.

Was Manhattan Retirement Foundation d/b/a Meadowlark Hills attacked by a ransomware group?

Yes — the Beast Ransomware-as-a-service group claimed responsibility for the attack on Manhattan Retirement Foundation d/b/a Meadowlark Hills. The stolen data was posted publicly on a dark-web leak site.

Should I file a lawsuit over the Manhattan Retirement Foundation d/b/a Meadowlark Hills data breach?

2 plaintiffs' firms have publicly announced investigations or filed complaints related to the Manhattan Retirement Foundation d/b/a Meadowlark Hills breach: Strauss Borrelli (publicly investigating), Shamis & Gentile (publicly investigating). We are not a law firm and cannot give legal advice; consult your own attorney to evaluate your options.

What is HealthConsent and how does it help with the Manhattan Retirement Foundation d/b/a Meadowlark Hills breach?

HealthConsent is an independent health-data privacy service. We help affected individuals stop the ongoing flow of their health information by filing HIPAA restriction requests, FTC Health Breach Notification Rule deletion requests, and state-law deletion requests across providers, insurers, Health Information Exchanges, prescription networks, and data brokers. Credit monitoring offered by Manhattan Retirement Foundation d/b/a Meadowlark Hills addresses identity-theft risk; HealthConsent addresses the longer-tail problem of your exposed health data continuing to be sold and shared by other entities downstream.

Active breach tracker Manhattan, KS Disclosed February 26, 2026

Meadowlark Hills (Manhattan Retirement Foundation) Data Breach 2026 (Beast Ransomware): 14,442 Kansas CCRC Residents Exposed. 750 GB Claimed Stolen. What To Do

Q: What data was exposed in the Manhattan Retirement Foundation d/b/a Meadowlark Hills breach?

According to the notification letter and supporting filings, the compromised data included: Full name, Social Security number, Date of birth, Driver's license / state ID, Government IDs, Financial account information, Credit / debit card information, Medical information, Health insurance policy information.

Meadowlark Hills, a Manhattan, Kansas continuing-care retirement community, disclosed in February 2026 a July 2025 Beast ransomware attack with approximately 750 GB of data claimed exfiltrated. 14,442 affected. Resident population is overwhelmingly elderly with high vulnerability to identity theft. 12 months Cyberscout monitoring offered. Here is what to do.

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated May 15, 2026 Sources & methodology

Timeline

Jul 12, 2025

Unauthorized network access window begins

Jul 21, 2025

Intrusion identified

Jan 28, 2026

Forensic file review completed

Feb 26, 2026

Filed with HHS OCR; individual notification letters mailed

Feb 27, 2026

Massachusetts AG filing

Jul 12, 2025

Unauthorized network access window begins

Jul 21, 2025

Intrusion identified

Jan 28, 2026

Forensic file review completed

Feb 26, 2026

Filed with HHS OCR; individual notification letters mailed

Feb 27, 2026

Massachusetts AG filing

Data exposed

High-risk identity

Enables financial + identity theft

Social Security number Date of birth Driver's license / state ID Government IDs

Contact & insurance

Phishing + targeted scams

Full name Financial account information Credit / debit card information Medical information Health insurance policy information

Class actions filed by

These firms have publicly announced investigations. You may be eligible to join. We are not a law firm and cannot give legal advice.

Strauss Borrelli (publicly investigating) Shamis & Gentile (publicly investigating)

If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

Accept credit monitoring

It’s the floor of the response. Take it.

Freeze your credit

Free at Equifax, Experian, TransUnion.

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

Review your EOBs

Insurance statements catch medical identity theft early.

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

What happened

Meadowlark Hills is a nonprofit continuing-care retirement community (CCRC) in Manhattan, Kansas, founded in 1980. The community offers independent living, assisted living, skilled-nursing, and transitional / respite care. ~500+ employees.

Between July 12 and July 21, 2025, an unauthorized actor accessed Meadowlark Hills’s network. Meadowlark Hills identified the intrusion on July 21. The forensic review concluded on January 28, 2026. Meadowlark Hills filed with HHS OCR and mailed individual notifications on February 26, 2026, filed with the Massachusetts AG on February 27, and saw a Strauss Borrelli class-action investigation announced on March 3 — confirming 14,442 affected individuals.

The Beast ransomware group claimed responsibility, asserting approximately 750 GB of exfiltrated data.

Why this matters: high-vulnerability population

The affected population is overwhelmingly elderly residents in independent living, assisted living, skilled-nursing, and transitional care. This demographic is a high-risk identity-theft cohort: fixed incomes, Medicare and Medicaid enrollment, cognitive-decline susceptibility to social engineering, and difficulty actively monitoring credit. The combination of SSN + DOB + financial account + medical data is a near-complete identity-theft toolkit for this group.

What was stolen

Full name, date of birth
Social Security number
Driver’s license / state ID and government IDs
Financial account information, credit / debit card information
Medical information
Health insurance policy information

What Meadowlark Hills is offering

Complimentary single-bureau credit monitoring, credit reports, and credit score (SSN-affected individuals only)
Proactive fraud assistance and remediation via Cyberscout (TransUnion)
Dedicated toll-free line: 1-844-937-3566 (Monday to Friday, 8 a.m. to 8 p.m. Eastern)

What to do (for affected residents and their family / guardians)

Enroll the resident in Cyberscout through the activation code in the letter. Family members and guardians can assist.
Place a credit freeze on behalf of the resident at all three bureaus (proof of guardianship required for each).
Cancel and reissue payment cards that may be tied to financial account information.
Watch the resident’s Medicare Summary Notices for unauthorized claims.
Stop the ongoing flow of LTC data. HealthConsent files HIPAA restriction requests across LTC networks and downstream entities.

Continue reading

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.