AccidentalHealthcareHealthcareMisdeliveryCustomer Data InvolvedEmployee Data InvolvedHealth (basic)Identity (basic)Government IDPHIMediumContained

Massachusetts General Hospital

bd_487649c39d94d97e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 23, 2026

Filed

Aug 10, 2026

To disclose

7 weeks

Affected

Not disclosed

Confidence

66%

Full breach record for Massachusetts General Hospital →76 incidents on file

Massachusetts General Hospital notified affected individuals on August 5, 2026, regarding a misdelivery of Protected Health Information (PHI) that occurred on or about May 28, 2026. A workforce member inadvertently emailed a form containing a child's name, DOB, address, phone, school, medical condition, and SSN to the wrong recipient. The notification was sent to Massachusetts residents. MGB provided 24 months of credit monitoring via Experian and implemented staff training and safeguard improvements.

J jump to incidentP pin to compareR raw source

Massachusetts clock⏱ MA AG >30d7 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 26 days

discovery → filing · 7 weeks / 48 days

May 28, 2026

Begins

Jun 23, 2026

Discovered

Aug 10, 2026

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Massachusetts General Hospital
norm: massachusetts general hospital
Domain: massgeneral.org

Name: Massachusetts General Hospital
norm: massachusetts general hospital
Domain: massgeneral.org
Industry: Healthcarellm

Discovered: Jun 23, 2026
Breach occurred: May 28, 2026
Undetected for: 26 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 5, 2026
Affected individuals: Not disclosed
Data types: Health (basic)Identity (basic)Government IDPHI
Attack vector: Unknown
MITRE ATT&CK: T1535 Unauthorized Access
Threat actor: Internal

During the incident: Provided 24 months of free credit monitoring and other services for your child through Experian’s IdentityWorks
Taken steps to investigate this matter
Implemented measures to help prevent similar incidents in the future
Taken additional steps to remind future interns of the importance of using Patient Gateway
Strengthened safeguards and promoted training, education, and accountability across workforce
Changes made: Reminded future interns of the importance of using Patient Gateway
Promoted training, education, and accountability across workforce
Strengthened safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(48 days from discovery to filing)
Compliance flags: MA AG >30d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1321-massachusetts-general-hospital/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 10, 2026
Raw hash: cd1e87f1e651b5c168cccf6ceffb1d47f79fea998dbfaa0fc28f6f5c1ecdaa12

Reporting entityMassachusetts General Hospital

Victim entityMassachusetts General Hospital

Incidentdiscovered Jun 23, 2026

Stated responseProvided 24 months of free credit monitoring and other services for your child through Experian’s IdentityWorks

ComplianceMA AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov