HackingData ExfiltratedCustomer Data InvolvedIDENTITY_BASICLowContained
Pennyroyal Healthcare Services
bd_00e17e09d8905269 · schema v1 · pii pii-v1
Full breach record for Pennyroyal Healthcare Services →Pennyroyal Healthcare Services (d/b/a Community Medical Clinic) notified Massachusetts residents of a data security incident. Unauthorized access occurred on or around January 2, 2026, detected on January 3, 2026. The breach involved personal information (names) of individuals served by the clinic. Notices were mailed on July 22, 2026, offering 24 months of credit monitoring and fraud assistance via Cyberscout/TransUnion.
Massachusetts clock✗ MA AG >90d26 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://www.mass.gov/doc/2026-1224-pennyroyal-healthcare-services/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 1, 2026
- Raw hash
- 14f2a4b00049fd36190bf8eb42c4e1d7da0c6c2f5e35f826ca4954adcc822939
Reporting entity
- Name
- Pennyroyal Healthcare Servicesnorm: pennyroyal healthcare
Victim entity
- Name
- Pennyroyal Healthcare Servicesnorm: pennyroyal healthcare
Incident
- Discovered
- Jan 3, 2026
- Materiality determined
- —
- Notification sent
- Jul 22, 2026
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 26 weeks(179 days from discovery to filing)
- Compliance flags
- MA AG >90d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.