RansomwareLegalTeam.com

Got a notice from Included Health? Here’s what to do.

Included Health told the Massachusetts Attorney General that people’s information was exposed. If you got a letter, work through the steps below.

Your checklist

  1. 1

    Keep the letter

    Save the notice from Included Health and its envelope. The date you were told can matter for legal deadlines.

  2. 2

    Freeze your credit

    The filing does not list what was taken, so play it safe. A free freeze at Equifax, Experian and TransUnion stops new accounts being opened in your name.

  3. 3

    Change reused passwords

    Change any password you used with this company or reused elsewhere, and turn on two-factor sign-in.

  4. 4

    Get a free claim review

    Our legal team checks whether you can be paid for this breach. No fee unless you recover.

Step 4: free claim review

Tell us you got the Included Health notice. An attorney, not a call center, reads it and tells you plainly whether you have a claim.

  • Free, no obligation
  • No fee unless you recover
  • Reply within 24 hours

Got a Notification Letter? Find Out If You Qualify

Free review. No cost, no obligation.

Upload your breach letter (optional)

No attorney-client relationship is created by submitting this form. Attorney Advertising.

About the Included Health breach

Reported to
Massachusetts Attorney General
Date filed
February 13, 2025
People notified
Not stated
Cause in filing
Not stated

Included Health operates at the intersection of modern healthcare delivery, telemedicine, and healthcare navigation, serving as a vital bridge between patients, employers, and medical providers. Because the company coordinates complex medical care, expert second opinions, mental health services, and insurance advocacy, it maintains vast repositories of deeply intimate patient files. This includes comprehensive health histories, detailed treatment notes, insurance claims data, and direct communications between patients and medical professionals. The sheer volume and sensitivity of this centralized health data make organizations like Included Health prime targets for cybercriminals seeking to exploit high-value personal information. In 2025, Included Health reported a significant data security incident to the Massachusetts Attorney General, alerting regulators and consumers to an unauthorized compromise of its network environment. In the healthcare technology sector, incidents of this magnitude typically involve sophisticated cyberattacks such as ransomware deployments, unauthorized intrusions into cloud-hosted patient management databases, or vulnerabilities exploited within third-party vendor software supply chains. Once unauthorized actors breach these perimeter defenses, they often retain unchecked access to internal systems for extended periods, allowing them to exfiltrate vast quantities of confidential files before detection mechanisms trigger an alarm. The exposure resulting from the Included Health security incident implicates several categories of highly sensitive information, each presenting distinct and severe risks to affected individuals. Compromised medical records, treatment details, and health insurance identifiers expose victims to coordinated medical fraud, where unauthorized parties obtain unauthorized medical services or prescription drugs billed to the victim's insurance or identity. Furthermore, the simultaneous exposure of core identifiers such as full names, dates of birth, and Social Security numbers opens the door to multi-faceted identity theft, tax fraud, and unauthorized financial account takeover. Unlike standard retail breaches involving easily replaceable credit cards, deeply personal health and identity data cannot be changed, leaving victims vulnerable to lifelong risks. As an entity handling protected health information, Included Health was bound by strict statutory and regulatory mandates, most notably the Health Insurance Portability and Accountability Act (HIPAA), alongside state-level data privacy statutes and common-law duties of care. These legal frameworks require organizations to implement robust administrative, physical, and technical safeguards, including continuous network monitoring, end-to-end encryption, multi-factor authentication, and rigorous vendor risk management. The occurrence of a widespread data breach strongly suggests systemic failures in these security protocols, indicating that the company may have fallen short of its legal obligations to protect confidential consumer and patient data from foreseeable digital threats. Receiving an official data breach notification letter from Included Health is a formal acknowledgment that your private information was compromised due to inadequate security measures. Under established legal principles, the receipt of this notice establishes the concrete legal standing necessary to participate in a class action lawsuit aimed at holding the company accountable. Affected individuals do not need to demonstrate that they have already suffered actual financial loss or medical identity theft to seek legal redress; the increased, imminent risk of future harm is sufficient. Our firm is currently investigating potential class action claims against Included Health on a strict contingency fee basis, meaning there are no out-of-pocket costs or attorney fees unless we successfully recover compensation on your behalf.

Full ransomware checklist

Included Health data breach questions

Is the Included Health data breach letter legit or a scam?
A notice from Included Health in the mail matches the breach Included Health reported to the Massachusetts Attorney General on February 13, 2025. Check that the company name and dates in your letter match that filing. A real notice of data security incident won't ask for your password, Social Security number or a payment — if it does, contact Included Health through a phone number or website you find yourself.
Did Included Health offer free credit monitoring?
Look for an enrollment code in your Included Health notice. Companies that offer free credit monitoring after a breach usually include it there, with a deadline to activate. Using the free service won't stop you from joining a lawsuit or settlement later.
Is there a Included Health data breach class action lawsuit?
Law firms often open an investigation after a breach notice like this one, and a class action lawsuit may follow. This page doesn't confirm that a lawsuit has been filed against Included Health. You usually don't have to join a class action to be included — if a settlement is reached, class members are notified and can file a claim.
What should I do after getting the Included Health data breach notice?
Keep the letter and the envelope, and note the date it arrived. Freeze your credit with Equifax, Experian and TransUnion, change any passwords the notice mentions, and sign up for any free credit monitoring the letter offers. Then check whether you may have a claim.
Do I need a Included Health data breach lawyer or attorney?
An attorney can read your notice and tell you whether a claim makes sense. A case review here is free, and data breach cases are usually handled on contingency, so there is no upfront cost.
Can I sue Included Health over the data breach?
It depends on what was exposed, the law in Massachusetts and your own state, and whether you've been harmed. Most people take part through a class action rather than suing alone. Keep your notification letter — it's the proof that connects you to the breach.
How much could a Included Health data breach settlement or claim be worth?
There is no set amount, and no Included Health settlement is confirmed here. In past data breach settlements, payments depended on what data was exposed and on documented losses — fraud, out-of-pocket costs and time spent dealing with the breach. Keep receipts and records; they're what damages claims are built on.

Other notices sent in Massachusetts

Attorney advertising. This page reflects a public regulator filing; it does not mean a lawsuit has been filed or that the company did anything unlawful. Submitting a review request does not create an attorney-client relationship.