Elara Caring notified Massachusetts residents of a data security incident involving a third-party vendor. Between November 4-6 and November 14-17, 2025, an unauthorized actor accessed patient documents containing personal information, including Social Security numbers. Elara terminated the vendor relationship, conducted a security review, and provided 24 months of complimentary credit monitoring via Cyberscout/TransUnion. The incident was discovered in March 2026, with notifications sent in May 2026.