HackingHealthcareHealthcareSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)PIILowContained

North East Medical Services Foundation

bd_2f886d386697a646 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 19, 2025

Filed

Feb 19, 2026

To disclose

18 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for North East Medical Services Foundation →2 incidents on file

North East Medical Services (NEMS) detected potential unauthorized access to data on its third-party managed service provider, United Layer, on October 19, 2025. An investigation involving third-party forensic specialists confirmed that certain data related to affected individuals may have been impacted. The potentially affected information includes first and last name in combination with other exposed data elements. NEMS is offering complimentary credit monitoring through Cyberscout.

J jump to incidentP pin to compareR raw source

Massachusetts clock✗ MA AG >90d18 weeks discovery → filing

Incident timeline

discovery → filing · 18 weeks / 123 days

Oct 19, 2025

Discovered

Feb 19, 2026

Filed

vs. sector median

+5 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_8f92823183511bb72026-02-18 · +1dVerified
HHS OCRbd_ecbbe66c18d133bd2025-12-18 · +63dVerified

Name: North East Medical Services Foundation
norm: north east medical

Name: North East Medical Services Foundation
norm: north east medical
Industry: Healthcarellm

Discovered: Oct 19, 2025
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)PII
Attack vector: Third-Party / Supply Chain
Threat actor: External
Third party: via United Layer
Initial access: supply_chain

During the incident: Took steps to secure its environment
Conducted a comprehensive investigation
Engaged third-party forensic specialists
Reviewed potentially impacted information to assess potential notification obligations
Providing an offer of complimentary credit monitoring through Cyberscout
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(123 days from discovery to filing)
Compliance flags: MA AG >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

HHS OCRDec 18 · first

California State AG+62d

Massachusetts State AG+63d · this page

Pattern: first filing Dec 18 (CA), last Feb 19 (MA) — a 63-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-234-north-east-medical-services-0/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 19, 2026
Raw hash: 67e8db65e653a18d8562ae44489e31d71e3f46362d307d28eea52e911cb74faf

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityNorth East Medical Services Foundation

Victim entityNorth East Medical Services Foundation

Incidentdiscovered Oct 19, 2025

Stated responseTook steps to secure its environment

ComplianceMA AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov