HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPHIGovernment IDIdentity (basic)Health (basic)MediumContained

Gastroenterology & Hepatology of Central New York, P.C.

bd_14fb7b0589672e1b · schema v1 · pii pii-v2

Severity

Medium

Discovered

Mar 6, 2026

Filed

Sep 23, 2026

To disclose

29 weeks

Affected

32state residents only

Linked

2 filings

Confidence

69%

Full breach record for Gastroenterology & Hepatology of Central New York, P.C. →

Gastroenterology & Hepatology of Central New York, P.C. notified the NH Attorney General of a data security incident affecting approximately 32 New Hampshire residents. On March 6, 2026, an unauthorized party accessed network systems. Forensic investigation concluded on August 28, 2026, that records containing PHI, SSNs, and other PII were acquired. The organization contained the threat, notified law enforcement, and engaged external cybersecurity professionals. Credit monitoring services were offered to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 29 weeks / 201 days

Mar 6, 2026

Begins

Mar 6, 2026

Discovered

Sep 23, 2026

Filed

vs. sector median

+20 wks slower

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_fef82cc3cccbea102026-09-01 · +22dCandidate

Name: Gastroenterology & Hepatology of Central New York, P.C.
norm: gastroenterology & hepatology of central new york

Name: Gastroenterology & Hepatology of Central New York, P.C.
norm: gastroenterology hepatology of central new york
Industry: Healthcarellm

Discovered: Mar 6, 2026
Breach occurred: Mar 6, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 17, 2026
Affected individuals: 32state-resident count only
Data types: PHIGovernment IDIdentity (basic)Health (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified local law enforcement and the FBI

During the incident: Immediately contained the threat
Notified local law enforcement and the FBI of the incident
Commenced a prompt and thorough investigation on March 6, 2026
Working very closely with external cybersecurity professionals experienced in handling these types of incidents
Offering the affected residents whose Social Security numbers were impacted complimentary memberships with a credit monitoring service
Changes made: Continually evaluates and modifies its practices to enhance the security and privacy of the personal information it maintains
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 weeks(201 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGSep 1 · first

New Hampshire State AG+22d · this page

Pattern: first filing Sep 1 (MA), last Sep 23 (NH) — a 22-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/gastroenterology-hepatology-central-new-york-20260923.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 23, 2026
Raw hash: 0cf78cf9ae0740eee59813220ba5f3d4aa4ce1513291e5d51d72b6ecf5e51c78

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityGastroenterology & Hepatology of Central New York, P.C.

Victim entityGastroenterology & Hepatology of Central New York, P.C.

Incidentdiscovered Mar 6, 2026

Stated responseImmediately contained the threat

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov