Social EngineeringHealthcareHealthcarePhishingCustomer Data InvolvedHealth (basic)Identity (basic)Government IDMediumContained

Averhealth Holdings

bd_17f50c1a37bd6a4c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 20, 2026

Filed

Jul 7, 2026

To disclose

24 weeks

Affected

34state residents only

Linked

4 filings

Confidence

67%

Full breach record for Averhealth Holdings →

Averhealth Holdings notified Massachusetts and New York residents of a security incident detected on January 20, 2026, involving unauthorized access to email environments. The breach exposed personal information, including names and government identifiers (Social Security numbers). The company engaged Kroll for 12 months of credit monitoring and fraud consultation services for affected individuals.

J jump to incidentP pin to compareR raw source

Massachusetts clock✗ MA AG >90d24 weeks discovery → filing

Incident timeline

discovery → filing · 24 weeks / 168 days

Jan 20, 2026

Discovered

Jul 7, 2026

Filed

vs. sector median

+11 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

HHS OCRbd_f6ed28c3b18e73b42026-07-02 · +5dVerified
Vermont State AGbd_61124ed0d7b945af2026-07-15 · +8dVerified
New Hampshire State AGbd_9df113154ca2a6b72026-07-20 · +13dVerified

Name: Averhealth Holdings
norm: averhealth holdings
Domain: averhealth.com

Name: Averhealth Holdings
norm: averhealth holdings
Domain: averhealth.com
Industry: Healthcarellm

Discovered: Jan 20, 2026
Materiality determined: —
Notification sent: —
Affected individuals: 34state-resident count only
Data types: Health (basic)Identity (basic)Government ID
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Secured our email environment
Launched an investigation in consultation with outside cybersecurity professionals
Devoted considerable time and effort to determine what, if any, information was impacted
Secured the services of Kroll to provide identity monitoring at no cost to you for 12 months
Changes made: Continually evaluate and modify our practices and internal controls to enhance the security and privacy of your personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(168 days from discovery to filing)
Compliance flags: MA AG >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

HHS OCRJul 2 · first

Massachusetts State AG+5d · this page

Vermont State AG+13d

New Hampshire State AG+18d

Pattern: first filing Jul 2 (VA), last Jul 20 (NH) — a 18-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1093-averhealth-holdings/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 7, 2026
Raw hash: d9a04d2b3ab033e3c043125efbd8257169fbdf9ce722082dbb23bec07ea86bb8

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityAverhealth Holdings

Victim entityAverhealth Holdings

Incidentdiscovered Jan 20, 2026

Stated responseSecured our email environment

ComplianceMA AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov