MisuseHealthcareEducationHealthcareData MishandlingCustomer Data InvolvedEmployee Data InvolvedPHIIdentity (basic)Health (basic)EducationFinancial accountLowContained

Kid CenterEd, PLLC

bd_46ce0d805b697bea · schema v1 · pii pii-v2

Severity

Low

Discovered

Jul 24, 2026

Filed

Sep 22, 2026

To disclose

9 weeks

Affected

9state residents only

Linked

3 filings

Confidence

68%

Full breach record for Kid CenterEd, PLLC →

Kid CenterEd, PLLC notified the NH Attorney General that a former employee improperly downloaded files containing PHI and PII for 9 NH residents. The unauthorized access occurred on June 18-19, 2025, and was discovered on July 24, 2026. Affected data included names, addresses, IEPs, evaluations, and credit card authorization forms. No SSNs or bank account numbers were involved. Kid CenterEd suspended the employee's accounts, engaged forensic experts, and notified affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 401 days

discovery → filing · 9 weeks / 60 days

Jun 18, 2025

Begins

Jul 24, 2026

Discovered

Sep 22, 2026

Filed

vs. sector median

1 wks faster

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Vermont State AGbd_c2d0c70628a291052026-09-22Verified
Massachusetts State AGbd_de1b35eff8a8d9c52026-09-01 · +21dCandidate

Name: Kid CenterEd, PLLC
norm: kid centered
Domain: kidcentered.net

Name: Kid CenterEd, PLLC
norm: kid centered
Domain: kidcentered.net
Industry: HealthcarellmEducationllm

Discovered: Jul 24, 2026
Breach occurred: Jun 18, 2025 – Jun 19, 2025
Undetected for: 401 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 22, 2026
Affected individuals: 9state-resident count only
Data types: PHIIdentity (basic)Health (basic)EducationFinancial account
Attack vector: Insider
Threat actor: Internal
Regulator citations: Providing written notice of this incident to relevant state and federal regulators, as necessary
Initial access: insider_action

During the incident: Suspending all former employee accounts to prevent any further unauthorized access to our systems
Engaging outside legal counsel experienced in data privacy and security matters to conduct a thorough investigation and analysis
Retaining a digital forensic expert to analyze the scope and nature of the unauthorized file access
Conducting a comprehensive review of all affected files to identify the individuals and types of information involved
Providing written notice of this incident to relevant state and federal regulators, as necessary
Pursuing legal action against the former employee for breach of contractual confidentiality obligations
Changes made: Providing impacted individuals with guidance on how to protect against identity theft and fraud
Providing individuals with information on how to place a fraud alert and security freeze on one’s credit file
Providing contact details for the national consumer reporting agencies
Providing information on how to obtain a free credit report
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGSep 1 · first

Vermont State AG+21d

New Hampshire State AG+21d · this page

Pattern: first filing Sep 1 (MA), last Sep 22 (NH) — a 21-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/kid-centered-20260922.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 22, 2026
Raw hash: b72e91c6572e15b93584fe6ecc65a4baaef667932203c1fba551e5b9dae21207

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityKid CenterEd, PLLC

Victim entityKid CenterEd, PLLC

Incidentdiscovered Jul 24, 2026

Stated responseSuspending all former employee accounts to prevent any further unauthorized access to our systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov