UnknownHealthcareHealthcareCustomer Data InvolvedPIIIdentity (basic)Government IDMediumContained

SOUND HSA, Inc.

bd_01eddfa377fb7812 · schema v1 · pii pii-v2

Severity

Medium

Discovered

—

Filed

Sep 1, 2026

To disclose

—

Affected

1state residents only

Confidence

69%

Full breach record for SOUND HSA, Inc. →2 incidents on file

SOUND HSA, Inc. notified Massachusetts residents of a security incident involving personal information. The letter states that upon becoming aware of the event, the company conducted an investigation and secured its network. Due to Massachusetts law, specific details about the nature of the event are withheld. The company is offering 24 months of credit monitoring via Cyberscout. No specific dates for discovery or occurrence are provided in the letter, only the notification date of September 18, 2026.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Sep 1, 2026

Filed

No interval is drawn: no breach start or discovery date is on record for this filing.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: SOUND HSA, Inc.
norm: sound hsa

Name: SOUND HSA, Inc.
norm: sound hsa
Industry: Healthcarellm

Discovered: —
Materiality determined: —
Notification sent: Sep 18, 2026
Affected individuals: 1state-resident count only
Data types: PIIIdentity (basic)Government ID
Attack vector: Unknown

During the incident: Conducted a diligent investigation to confirm the full nature and scope
Took prompt steps to ensure the security of our network
Undertook a comprehensive review of the files involved to identify what information was contained therein and to whom it relates
Implementing additional safeguards and reviewing policies and procedures relating to data privacy and security
Offering access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services for twenty-four (24) months at no cost
Changes made: Implementing additional safeguards and reviewing policies and procedures relating to data privacy and security
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1585-sound-hsa-inc/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 1, 2026
Raw hash: 2227b1cd277f461f7d32fe162dfea242eccdeaf13962842d4f86034efdefb0d0

Reporting entitySOUND HSA, Inc.

Victim entitySOUND HSA, Inc.

IncidentUnknown

Stated responseConducted a diligent investigation to confirm the full nature and scope

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov