FEDERALHackingHealthcareHealthcareStolen CredentialsCapture Stored DataExtortion DemandSupply Chain (3P Vendor)Data ExfiltratedRansom DemandedRansom PaidData Leak ThreatenedCustomer Data InvolvedTargetedPHIHealth (basic)MediumContained

Chemed Corporation

bd_3b6a8fca8fa8e0f1 · schema v1 · pii pii-v1

Severity

Medium

Financial impact

$500K

Discovered

Oct 24, 2025

Filed

Feb 27, 2026

To disclose

18 weeks

Affected

Not disclosed

Confidence

84%

Full breach record for Chemed Corporation →

On October 24, 2025, VITAS Healthcare (a Chemed subsidiary) discovered that a compromised third-party vendor account attempted to deploy an attacker tool in its IT environment. Protected health information of current and former patients was viewed and exfiltrated. On October 29, a threat actor demanded payment to prevent data release; VITAS paid and obtained deletion assurances. Incident contained; cyber insurance covered costs above a $500,000 deductible.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 18 weeks / 126 days

Oct 24, 2025

Begins

Oct 24, 2025

Discovered

Feb 27, 2026

Filed

vs. sector median

+6 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.No incident reportedView incident

Name: Chemed Corporation
norm: chemed

Name: Chemed Corporation
norm: chemed
SEC CIK: 19584
Industry: Healthcarellm

Discovered: Oct 24, 2025
Breach occurred: Oct 24, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIHealth (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1199 Trusted RelationshipT1041 Exfiltration Over C2 ChannelT1657 Financial Theft
Threat actor: ExternalFinancial
Regulator citations: VITAS has complied with the regulatory and legal notifications which are required as a result of this incident
Initial access: trusted_relationship

During the incident: VITAS' security team took immediate actions to contain and remove the intrusion
Notified the third-party vendor in accordance with its cyber incident response process
VITAS and external cybersecurity experts began an investigation into the incident
Successfully negotiated with the threat actor, made a payment, and obtained assurances that the PHI was not provided to any other third parties and has since been destroyed
Engaged third-party forensic analysts
Changes made: Implemented remedial measures
Further strengthened security permissions on third-party vendors and their access to the system
Integrated cybersecurity prevention and mitigation processes into overall risk management system
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(126 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/19584/000156276226000020/che-20251231x10k.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Feb 27, 2026
Raw hash: f40beae6793fbba7b1ffde0135e3e80b7642b4f413b4f3da8f2efe246e80f670

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html9.4 MB

Download View at source

Reporting entityChemed Corporation

Victim entityChemed Corporation

Incidentdiscovered Oct 24, 2025

Stated responseVITAS' security team took immediate actions to contain and remove the intrusion

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing