DisclosureLens
AccidentalHealthcareHealthcareMisdeliveryCustomer Data InvolvedEmployee Data InvolvedPHIIdentity (basic)Government IDHealth (basic)EducationMinorMediumResolved

Massachusetts General Hospital

bd_487649c39d94d97e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 23, 2026

Filed

Aug 10, 2026

To disclose

7 weeks

Affected

1state residents only

Confidence

66%
Full breach record for Massachusetts General Hospital →88 incidents on file

Massachusetts General Hospital notified a patient that a workforce member inadvertently sent an email containing the patient's Protected Health Information (PHI) and personal information to an incorrect address on May 28, 2026. The Privacy Office learned of the incident on June 23, 2026. The exposed data included the child's name, date of birth, address, phone number, school, medical condition, and Social Security number, as well as the parent's name and contact information. MGH is providing 24 months of complimentary credit monitoring through Experian IdentityWorks and has implemented additional training and safeguards to prevent recurrence.

Massachusetts clock⏱ MA AG >30d7 weeks discovery → filing

Incident timeline

undetected · 26 days
discovery → filing · 7 weeks / 48 days

May 28, 2026

Begins

Jun 23, 2026

Discovered

Aug 10, 2026

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.