HackingEmployee Data InvolvedHealth (basic)Identity (basic)Government IDPIIMediumContained

Recovery Café

bd_421ee9054f88ab07 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 30, 2026

Filed

Aug 6, 2026

To disclose

5 weeks

Affected

2state residents only

Linked

3 records

Confidence

64%

Full breach record for Recovery Café →

Recovery Café notified individuals of a data breach occurring between June 26 and June 30, 2026, discovered on June 30. An unauthorized party accessed the network, compromising employee and contractor data including names, contact info, SSNs, driver's licenses, and health insurance IDs. The company contained the incident, launched an investigation, and is offering 24 months of identity theft protection.

J jump to incidentP pin to compareR raw source

Massachusetts clock⏱ MA AG >30d5 weeks discovery → filing

Incident timeline

undetected · 4 days

discovery → filing · 5 weeks / 37 days

Jun 26, 2026

Begins

Jun 30, 2026

Discovered

Aug 6, 2026

Filed

This filing is one of 3 records about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitesafepaybd_2a75ef688b88b8642026-09-08 · +33dVerified by operator

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_eb83e3453d7d754b2026-08-06Verified by operator

Name: Recovery Café
norm: recovery cafe
Domain: recoverycafe.org

Name: Recovery Café
norm: recovery cafe
Domain: recoverycafe.org

Discovered: Jun 30, 2026
Breach occurred: Jun 26, 2026 – Jun 30, 2026
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 6, 2026
Affected individuals: 2state-resident count only
Data types: Health (basic)Identity (basic)Government IDPII
Data elements: Social Security numberDate of birth
Attack vector: Unknown
Threat actor: External

During the incident: Terminated the unauthorized party’s access and secured our network
Launched an investigation
Implementing more advanced security monitoring tools
Strengthening our access controls
Offering complimentary identity theft protection services through IDX
Changes made: Implementing more advanced security monitoring tools
Strengthening our access controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(37 days from discovery to filing)
Compliance flags: MA AG >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGAug 6 · first

Massachusetts State AGAug 6 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1302-recovery-cafe/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 6, 2026
Raw hash: c50bd5a4b4e7c3393603a02423c0c7cc3e253b6faada3b447d9a9423984c6eb0

Linked disclosures

Ransomware claims (1)

Regulatory filings (1) · sorted by filing gap

Reporting entityRecovery Café

Victim entityRecovery Café

Incidentdiscovered Jun 30, 2026

Stated responseTerminated the unauthorized party’s access and secured our network

ComplianceMA AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov