AngMar Confirms Home-Health Data Theft; Interlock Claims 710 GB

AngMar Management Services — a privately held home-health and hospice management company in Mansfield, Texas — told patients that an unauthorized actor may have accessed or acquired files on or around July 18, 2026. The company identified unusual network activity on July 20, finished its data review on September 8, and mailed notices dated September 22.

This is a confirmed company notice, not a rumor. The sample letter lists names, addresses, dates of birth, Social Security numbers, patient IDs, medical record numbers, insurance, dates of service, diagnosis or condition, providers, prescriptions, and medical history. HHS OCR later posted 126,196 individuals (September 16). The Texas Attorney General lists 35,916 Texans (published September 25).

HIPAA Journal and SecurityWeek report that the Interlock ransomware group added AngMar to a leak site in August 2026 and claimed about 710 GB. AngMar’s letter does not name a crew or confirm that volume. Treat the leak-site figure as a claim.

AngMar manages more than 90 locations in 11 states under brands including Angels Care Home Health. Headquarters on the public site: 2301 FM 1187, Suite 203, Mansfield, TX 76063. A separate July 2026 social-engineering notice from Clover Health is a different victim.

Snapshot

What AngMar told patients

The September 22 letter says AngMar hired outside forensics, secured systems, and has no evidence of misuse so far. It still offered 12 months of single-bureau credit monitoring through Cyberscout (a TransUnion company).

Help line: 1-877-520-9311, Monday–Friday 8 a.m.–8 p.m. ET. Mail: AngMar Management Services, c/o Cyberscout, PO Box 1286, Dearborn, MI 48120-9998. Company contact on the public site remains info@angmarms.com / 877-469-6739.

OCR lists AngMar as a business associate. HIPAA Journal also notes other state AG filings. Do not treat the Texas count as the nationwide total — OCR is larger.

Interlock claim — and the Texas lawsuits

Interlock’s August listing is allegation-led. We do not link leak sites or quote samples. The 2024 Interlock claim against Texas Tech University Health Sciences Center is a different victim and year.

CourtListener already has Northern District of Texas putative class actions against AngMar Medical Holdings, Inc.:

Those RECAP rows are diversity / personal-injury filings. They are not a finding that Interlock’s 710 GB figure is true.

What patients and staff should do

1. Type angmarms.com or use the number on your letter. Do not use a “records restored / Interlock portal” link from email or text.
2. Enroll in Cyberscout only from the letter. The help line is 1-877-520-9311.
3. Freeze credit and watch bank, Medicare, and insurance EOBs if you received Angels Care or another AngMar-managed service.
4. Staff and referral partners: reset work passwords on a host you typed. Assume follow-on payroll and “your hospice file is online” phishing.
5. Texas residents can confirm the OAG row at the Texas breach portal. Nationwide: IC3.

MFA: YubiKey and Google Authenticator

A hardware key does not un-copy files that already left the network. It does cut a lot of the follow-on “verify your chart / Cyberscout / W-2” phishing that follows a hospice headline. Grades match our MFA directory.

angmarms.com is a marketing site. It publishes no patient- or staff-portal MFA help that names a YubiKey or Google Authenticator. We do not invent an Angels Care MyChart tenant. MFA would not have recalled the July files; it still matters for the mail that comes next.

Directory: MFA support directory · Category → Healthcare.

Recommended MFA tools

We may earn a commission if you buy a YubiKey or sign up for Proton Pass through the links above.

Independent cybersecurity audits

We audited the official AngMar host, a shorter brand host, HIPAA Journal, and the Texas OAG on October 11, 2026. 100% is the ideal — none reach it. These scores are public email / transport / website posture. They do not say how the July files were reached.

Audit links: angmarms.com · angmar.com · hipaajournal.com · texasattorneygeneral.gov

angmar.com Identity 0% is the spoofing risk: a fake “Cyberscout enrollment / Interlock takedown” message is easier to deliver than the overall 32% suggests. Type angmarms.com. Transport 15% on all four hosts means inbound mail can still be downgraded without MTA-STS enforce.

Website stack note

Passive website-tech probes on October 11, 2026:

Point-in-time only. A live marketing homepage is not a forensic finding on the copied files.

Blacklist and lookalike domains

Email blacklist checks (public DoH, October 11, 2026): angmarms.com, hipaajournal.com, and texasattorneygeneral.gov were clear on mail/domain lists we can query. angmar.com showed UCEPROTECT Level 3 plus SPFBL on a shared MX — low-signal provider-netblock noise, not proof the company is “blacklisted.” Wix and OAG web/CDN SPFBL notes are informational only.

DNS lookalike scans (BEC profile, registered signals only):

High-interest registered names (investigate; not proof this incident used them):

texasattorneygeneral.com redirected to the real .gov host when we checked. Type angmarms.com, not a one-letter swap. Continuous monitoring: Cybersquat Domain Monitoring.

Related coverage

• Clover Health social engineering / HHS 138,677 (same-week SecurityWeek pair; different victim)
• Texas Tech HSC / Interlock 2024 event
• HHS OCR week of Sep 16
• Texas OAG week of Sep 25
• Texas healthcare breaches 2026
• Nutex Health / The Gentlemen claim
• MFA support directory

Run a free audit at audit.emailmenow.com or contact EmailMeNow for healthcare DMARC / MTA-STS and phishing response aimed at the 100% ideal.