Data breach at Fundamental Administrative Services affected 56,235 patients at long-term care facilities

On March 21, 2025, Fundamental Administrative Services, LLC (“Fundamental”), a Maryland-headquartered service provider to long-term care facilities, notified HHS of a breach involving unauthorized access to its network. At the time, they used a “500” placeholder for the number affected, but also posted a substitute notice on their website.

This week, Fundamental issued a press release about the incident, and at some point, their report to HHS was updated to reflect that 56,325 patients had been affected.

According to their press release and substitute notice, Fundamental first became aware of suspicious activity on its network on  January 20, 2025. Their investigation revealed that there was unauthorized access between October 27, 2024 and January 13, 2025. They offer no explanation for why it was not detected in October or earlier than months later.

Their internal review revealed that the types of information involved name, Social Security number, driver’s license or state identification number, financial account information, date of birth, medical treatment information, health insurance policy number, and/or Medicare/Medicaid plan name.

The firm’s website substitute notice states that the firm was providing notice on behalf of its covered entities, listed below.

There is  no mention of any free complimentary monitoring or restoration services.