The Aveanna Healthcare lawsuit picture is not a single case but a cluster: two federal class actions over a 2023 data breach, a state attorney general settlement tied to an earlier phishing attack, a shelved billion-dollar acquisition that drew Federal Trade Commission scrutiny, a Department of Justice antitrust grand jury subpoena into nurse wages, and Delaware litigation alleging the sellers who created Aveanna inflated the price through falsified financials.
The 2023 Data Breach and the Class Actions That Followed
Aveanna detected unusual activity in a company email account on September 22, 2023, and later determined that an unauthorized actor had gained access to its email environment by September 25, 2023. The company did not confirm that personal information had been compromised until March 12, 2024, and mailed notification letters on March 15, 2024.1PR Newswire. Aveanna Healthcare Notifies Individuals of Data Security Incident The breach affected 65,482 individuals according to a filing with the U.S. Department of Health and Human Services.2USA Today. Aveanna Healthcare Data Breach
Compromised data included names, Social Security numbers, driver’s license numbers, dates of birth, medical diagnoses, treatment records, prescription information, health insurance details, and Medicare and Medicaid numbers.1PR Newswire. Aveanna Healthcare Notifies Individuals of Data Security Incident
Two federal class actions followed in the U.S. District Court for the Northern District of Georgia. Young v. Aveanna Healthcare, LLC (Case No. 1:24-cv-01882), filed April 30, 2024, by plaintiff Elaine Young on behalf of workers, alleged that Aveanna failed to safeguard the personal information exposed in the attack.3CourtListener. Young v. Aveanna Healthcare, LLC4Law360. Arby’s Franchise, Auto Dealer Hit With GA Data Breach Suits The case was terminated on June 20, 2024.
The second suit, T.C. v. Aveanna Healthcare, LLC (Case No. 1:24-cv-02152), was filed May 16, 2024, on behalf of a minor plaintiff through his guardian, Elizabeth Roberts. It accused Aveanna of “negligent cybersecurity” and a failure to implement “basic data security protocols,” and sought to represent everyone in the United States whose information was compromised. The complaint also called Aveanna’s breach notification “unreasonably delayed.”5ClassAction.org. Class Action Lawsuit Filed Over September 2023 Aveanna Healthcare Data Breach
On July 12, 2024, Judge Michael L. Brown granted a joint motion to stay the T.C. case after the parties reported reaching an individual settlement. The court administratively closed the case while terms were finalized, with instructions to file a dismissal or to reopen if negotiations fell apart.6Justia. T.C. v. Aveanna Healthcare, LLC As of early 2026, no public record indicates the case has been formally dismissed or reopened.
A Second Breach in 2024
Aveanna disclosed a second incident before the first had run its course. On April 17, 2024, the company detected unusual activity in 11 employee email accounts. It confirmed by June 12, 2024, that protected health information may have been exposed, and mailed notification letters on July 12, 2024.7Aveanna Healthcare. Aveanna Healthcare Substitute Notice The second breach affected 10,482 patients and involved the same categories of sensitive information as the earlier incident.8HIPAA Journal. Aveanna Healthcare Breach 11 Email Accounts No formal HIPAA enforcement action has been publicly disclosed in connection with either the 2023 or 2024 breach.
The 2019 Phishing Attack and the Massachusetts Settlement
The recent incidents were not the first. In July 2019, employees began receiving phishing emails aimed at stealing login credentials. By August 2019, attackers had accessed parts of the network, sent more than 600 phishing messages internally, and attempted to reroute direct deposit information through the human resources system. Social Security numbers, financial account numbers, driver’s license numbers, and health records of more than 4,000 patients and employees were compromised.9TechTarget. Aveanna Healthcare Reaches $425K Settlement After Healthcare Data Breach
In November 2022, Massachusetts Attorney General Maura Healey announced a $425,000 settlement with Aveanna over that incident. The attorney general alleged the company had failed to implement basic protections against phishing, lacked multi-factor authentication, provided inadequate employee security training, and fell short of both state data security regulations and federal HIPAA standards.10Massachusetts Attorney General. Home Health Care Company to Pay $425,000 Following Data Breach Impacting Thousands of Massachusetts Residents
The consent judgment required Aveanna to implement a comprehensive information security program with phishing protection and multi-factor authentication, deploy intrusion detection systems, provide ongoing phishing-awareness training, and undergo annual independent compliance assessments for four years. Any employee who had not completed security training within the prior twelve months was to be barred from accessing protected health information.11HIPAA Journal. Georgia Home Health Company Settles Phishing Investigation and Pays $425,000 Penalty Aveanna denied wrongdoing.9TechTarget. Aveanna Healthcare Reaches $425K Settlement After Healthcare Data Breach
The T.C. complaint over the 2023 breach leaned on the 2019 incident, treating it as evidence of a pattern of negligent security practices at a company already operating under a consent judgment that required enhanced cybersecurity.5ClassAction.org. Class Action Lawsuit Filed Over September 2023 Aveanna Healthcare Data Breach
The FTC and the Failed Maxim Acquisition
In 2019, Aveanna announced plans to buy the home health care division of Maxim Healthcare Services in a deal valued at $1.25 billion. The Federal Trade Commission investigated, raising concerns about potential anticompetitive effects in the markets for nursing services and private duty nursing care.12Home Health Care News. Aveanna Healthcare’s $1.2B Acquisition of Maxim Collapses Under Weight of FTC Investigation The parties abandoned the transaction rather than face enforcement, and the FTC closed its investigation by a unanimous 5-0 vote on January 30, 2020. Chairman Joseph Simons said “patients and private-duty nurses will continue to benefit from competition between Aveanna and Maxim” now that the deal had ended.13Federal Trade Commission. Statement of FTC Chairman Regarding Announcement Aveanna Healthcare, Maxim Healthcare Services Have Terminated Acquisition Agreement
DOJ Antitrust Subpoena Over Nurse Wages
In January 2026, Aveanna disclosed that it had incurred between $2.8 million and $3.0 million in costs complying with a U.S. Department of Justice, Antitrust Division grand jury subpoena. The subpoena related to “nurse wages and hiring activities in certain of our markets” in connection with a previously terminated transaction. Aveanna included those costs within $3.9 million to $4.2 million in total acquisition-related legal expenses for its fiscal year ended January 3, 2026.14Aveanna Healthcare Holdings. Aveanna Healthcare Holdings Announces Updated Full Year 2025 Results The disclosure did not identify the specific transaction under investigation or describe the DOJ’s findings.
Fraud Claims in the Delaware Litigation Over Aveanna’s Founding Merger
Aveanna itself was formed in March 2017 through an all-cash $950 million merger of Epic Health Services and PSA Healthcare, backed by Bain Capital and J.H. Whitney Capital Partners.15PR Newswire. PSA Healthcare and Epic Health Services Complete Merger to Form Nation’s Largest Pediatric Home Health Provider
In Delaware litigation, Aveanna alleged that Epic/Freedom, LLC and its owner, Webster Capital Corporation, falsified financial statements to inflate the purchase price, manipulating an EBITDA model to induce a higher valuation. Epic counterclaimed that Aveanna had breached the stock purchase agreement by wrongfully withholding a federal tax refund owed to the sellers and by pulling $7.125 million from an indemnification escrow fund without giving Epic proper notice. According to court filings, Aveanna sent notice to the escrow agent but not to Epic, and the agent treated the withdrawal as uncontested. In July 2021, the Delaware Superior Court denied both sides’ motions for judgment on the pleadings and denied Epic’s summary judgment motion without prejudice, letting the dispute proceed toward trial.16Delaware Superior Court. Aveanna Healthcare, LLC v. Epic/Freedom, LLC
Quality-of-Care Scrutiny and Undisclosed Settlements
A 2019 Bloomberg investigation reported that after the Epic-PSA merger, Aveanna adopted cost-cutting measures that a former employee said included refusing to send nurses rather than pay overtime when short-staffed. The report linked the practices to the deaths of seven children in Texas, Pennsylvania, and Colorado. In 2021, the Centers for Medicare and Medicaid Services terminated the Medicare contract for Aveanna’s Valparaiso, Indiana location after the Indiana State Department of Health documented more than a dozen quality and safety deficiencies in the prior year.17Private Equity Stakeholder Project. Can Private Equity-Owned Aveanna Healthcare Dig Itself Out From Under a Pile of Debt
In its fiscal year 2025 disclosures, Aveanna reported releasing between $5.7 million and $5.9 million in legal reserves tied to “accrued legal settlements and the related costs and expenses associated with certain judgments and arbitration awards” where insurance coverage remained in dispute. The company did not publicly identify which cases those reserves covered.14Aveanna Healthcare Holdings. Aveanna Healthcare Holdings Announces Updated Full Year 2025 Results