Texas HHSC Data Breach 2026: 68,066 Medicaid/SNAP Recipients Exposed by Insider Employees. SNAP Fraud Tied to Breach. What To Do

What happened

The Texas Health and Human Services Commission (HHSC) administers Medicaid, SNAP (food stamps), TANF, CHIP, and long-term care benefits for approximately 7 million Texans. On November 21, 2024, HHSC learned that nine HHSC employees had improperly accessed protected health information of Medicaid and SNAP recipients between June 2021 and January 2025. Two of the implicated employees were specifically tied to theft from SNAP / Lone Star card benefits accounts. A separate Maximus (HHSC’s business associate) contractor was terminated for a related sub-incident affecting approximately 4,529 individuals between May 2023 and February 2025.

HHSC issued public notice tranches on January 17, 2025 (61,104 affected) and April 30, 2025 (additional 33,529 affected) — cumulative running total approximately 94,633. The HHS Office for Civil Rights filing dated January 5, 2026 confirms 68,066 affected in this specific tranche; this likely reflects continued reclassification of records identified in ongoing internal review.

All implicated employees and the Maximus contractor have been terminated. HHSC referred the matter to its Office of Inspector General and to prosecutors for criminal charges. The Texas Senate Finance Committee held public hearings in February 2025.

This is not an external hack. The attacker classification on this page reflects the insider-abuse pattern, even though HHS OCR coded the OCR tranche as Hacking/IT Incident (a common OCR categorization for insider access via internal network servers).

What was stolen

Per the HHSC substitute notice, exposed data includes:

• Full name, address, phone, date of birth, email address
• Social Security number
• Medicaid / Medicare ID
• Financial / banking information
• Employment information
• Benefits information (SNAP, TANF, CHIP)
• Health, insurance, and medical information
• Driver’s license / state licenses

The affected population is overwhelmingly Texas Medicaid and SNAP recipients — a population that includes children, elderly, and low-income Texans, many of whom may not be reachable via standard mail outreach.

What HHSC is offering

• Two years of complimentary credit monitoring and identity-theft protection
• Dedicated hotline: 866-362-1773 (engagement code B139792)
• SNAP fraud reporting through Texas 2-1-1

Class action and regulatory posture

A putative class action is pending in the US District Court for the Western District of Texas, Austin Division: H. v. Texas Health & Human Services Commission et al., 1:25-cv-01900. Sovereign-immunity defenses are likely to feature given the state-agency defendant. HHSC also has prior HIPAA history — a $1.6 million OCR civil money penalty in November 2019 for an unrelated 2015 ePHI exposure.

What to do

1. Enroll in the offered credit monitoring through engagement code B139792 if you received a notification letter.
2. Report SNAP / Lone Star card fraud through Texas 2-1-1 if you see unauthorized activity on your benefits account.
3. Place free credit freezes at Equifax, Experian, and TransUnion.
4. File IRS Form 14039 to prevent fraudulent tax filings.
5. Stop the ongoing flow of your Medicaid program data. HealthConsent files HIPAA restriction requests and state-law deletion requests so the benefits and demographic data exposed in this breach is not continuously re-shared by downstream entities.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches