AccidentalGovernmentGovernmentMisdeliveryCustomer Data InvolvedFinancial accountIdentity (basic)LowContained

Massachusetts Office of Consumer Affairs and Business Regulation

bd_3d4434eee4f15c6c · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 27, 2026

Filed

Jul 29, 2026

To disclose

2 days

Affected

1state residents only

Confidence

66%

Full breach record for Massachusetts Office of Consumer Affairs and Business Regulation →2 incidents on file

Massachusetts OCABR inadvertently disclosed financial account and routing numbers, along with names, to a Massachusetts attorney responding to a public records request on June 1, 2026. OCABR discovered the error on July 27, 2026, contacted the recipient, and secured deletion of the data. The incident was reported to the MA Attorney General.

J jump to incidentP pin to compareR raw source

Massachusetts clock✓ MA AG ≤30d2 days discovery → filing

Incident timeline

undetected · 56 days

discovery → filing · 2 days

Jun 1, 2026

Begins

Jul 27, 2026

Discovered

Jul 29, 2026

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Massachusetts Office of Consumer Affairs and Business Regulation
norm: massachusetts office of consumer affairs and business regulation

Name: Massachusetts Office of Consumer Affairs and Business Regulation
norm: massachusetts office of consumer affairs and business regulation
Industry: Governmentllm

Discovered: Jul 27, 2026
Breach occurred: Jun 1, 2026
Undetected for: 56 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 29, 2026
Affected individuals: 1state-resident count only
Data types: Financial accountIdentity (basic)
Attack vector: Misconfiguration
MITRE ATT&CK: T1567 Deception: Spearphishing LinkT1005 Data from Local System
Regulator citations: Reported this incident to the Office of the Attorney General as required by M.G.L. c. 93H

During the incident: Reached out to the recipient of the public record
Provided an updated record that did not include financial account information
Reported this incident to the Office of the Attorney General as required by M.G.L. c. 93H
Changes made: Will continue to review all public records to ensure no protected information is included
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 2 days(2 days from discovery to filing)
Compliance flags: MA AG ≤30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1244-office-of-consumer-affairs-and-business-regulation/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 29, 2026
Raw hash: 0dcb0a2dcd6d961aa79e277c596a8c074dc6f550bdeabef329d928f36b6a58ae

Reporting entityMassachusetts Office of Consumer Affairs and Business Regulation

Victim entityMassachusetts Office of Consumer Affairs and Business Regulation

Incidentdiscovered Jul 27, 2026

Stated responseReached out to the recipient of the public record

ComplianceMA AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov