HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedDelayed DiscoveryFinancial accountIdentity (basic)PCILowContained

The Massachusetts League of Community Health Centers, Inc.

bd_2a18e5b419048089 · schema v1 · pii pii-v2

Severity

Low

Discovered

Sep 1, 2025

Filed

Sep 1, 2026

To disclose

—

Affected

75state residents only

Confidence

68%

Full breach record for The Massachusetts League of Community Health Centers, Inc. →2 incidents on file

Massachusetts League of Community Health Centers, Inc. (MLCHC) notified individuals that an attacker likely accessed systems between March 20, 2025, and August 26, 2025, via compromised employee email accounts. MLCHC learned of the event in September 2025. Exposed data may include names, financial account numbers, and payment card numbers. No evidence of actual data access was found. Credit monitoring services are being offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 165 days

Mar 20, 2025

Begins

Sep 1, 2025

Discovered

Sep 1, 2026

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed75 affectedView incident

Name: The Massachusetts League of Community Health Centers, Inc.
norm: the massachusetts league of community health centers

Name: The Massachusetts League of Community Health Centers, Inc.
norm: the massachusetts league of community health centers
Industry: Healthcarellm

Discovered: Sep 1, 2025
Breach occurred: Mar 20, 2025 – Aug 26, 2025
Undetected for: 165 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 75state-resident count only
Data types: Financial accountIdentity (basic)PCI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External

During the incident: Engaged an outside cybersecurity consultant to investigate the cause and scope of the event
Providing access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge for 12 months
Providing proactive fraud assistance through Cyberscout
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1517-massachusetts-league-of-community-health-centers/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 1, 2026
Raw hash: a1dcad6cda72bb05ed0322a217412110f007304bb07c37f5ab9d611e4b6bad65

Reporting entityThe Massachusetts League of Community Health Centers, Inc.

Victim entityThe Massachusetts League of Community Health Centers, Inc.

Incidentdiscovered Sep 1, 2025

Stated responseEngaged an outside cybersecurity consultant to investigate the cause and scope of the event

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov