OCAT LLC dba Evoke Wellness at Hilliard Data Breach — Class Action Review

Operating as Evoke Wellness at Hilliard, OCAT LLC functions within the specialized and highly sensitive healthcare sector, providing comprehensive addiction treatment, behavioral health services, and rehabilitative care. Because of the nature of its clinical operations, the organization routinely collects and maintains vast repositories of deeply personal, confidential records. This includes not only standard administrative and demographic information, but also comprehensive medical histories, psychiatric evaluations, substance use disorder treatment details, billing records, and government-issued identification numbers necessary for insurance verification and clinical management. The entrusted data is among the most private and legally protected information an individual can possess, making the security infrastructure safeguarding it paramount to patient trust and regulatory compliance.

In 2026, OCAT LLC reported a significant data security incident to the New Hampshire Attorney General, raising serious concerns regarding the safety of the digital systems housing sensitive patient and administrative records. Incidents affecting specialized healthcare and wellness facilities typically involve unauthorized access to internal databases, compromise of network endpoints, or sophisticated ransomware attacks deployed by malicious threat actors seeking to exploit vulnerable healthcare infrastructure. Because healthcare networks often integrate multiple third-party vendors, electronic health record systems, and administrative portals, a vulnerability in any single node can expose sprawling databases containing unencrypted patient files and employee credentials.

The exposure resulting from this security failure threatens individuals with severe, multi-faceted harms that extend far beyond standard financial identity theft. When medical records, diagnoses, treatment histories, and health insurance details are compromised, victims face unique risks such as medical identity theft, where unauthorized parties obtain medical services or prescription drugs using the victim's identity, potentially corrupting their official medical history. Furthermore, the inclusion of core identifiers like Social Security numbers, full names, and dates of birth creates an immediate and long-term danger of financial account takeover, fraudulent credit applications, and tax fraud. For individuals seeking treatment for behavioral health and substance use, the breach of such intimate clinical details also represents an egregious violation of personal privacy and psychological well-being.

As a healthcare provider maintaining electronic protected health information, OCAT LLC dba Evoke Wellness at Hilliard was bound by stringent legal obligations under the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, and state consumer protection statutes. These laws mandate the implementation of robust administrative, physical, and technical safeguards, including comprehensive data encryption, continuous network monitoring, rigorous access controls, and regular vulnerability assessments. The occurrence of a data breach of this magnitude serves as a strong indicator of potential systemic failures in maintaining these mandatory security standards, suggesting that existing safeguards were inadequate to repel unauthorized access.

Receiving a formal data breach notification letter from OCAT LLC dba Evoke Wellness at Hilliard serves as an official acknowledgment that your private information was compromised due to corporate security shortcomings. Legally, the receipt of this notice establishes the concrete injury and standing necessary to participate in a class action lawsuit aimed at holding the organization accountable. Affected individuals do not need to wait until financial loss or medical fraud has actually occurred to seek legal recourse; the increased risk of future harm alone is sufficient. Our law firm is actively investigating this breach on a contingency fee basis, meaning there are never any out-of-pocket costs or upfront legal fees, and we only collect financial compensation if a successful recovery is secured on your behalf.