HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDPHIMediumContained

Ohio Living

bd_54726c240340d5df · schema v1 · pii pii-v2

Severity

Medium

Discovered

Apr 17, 2026

Filed

Oct 21, 2026

To disclose

27 weeks

Affected

6state residents only

Linked

2 filings

Confidence

69%

Full breach record for Ohio Living →5 incidents on file

Ohio Living notified the NH Attorney General of unauthorized access to its network between April 16-17, 2026, discovered on April 17, 2026. Approximately 6 New Hampshire residents were affected. Exposed data included names, addresses, Social Security numbers, and taxpayer identification numbers. The company engaged third-party cybersecurity specialists, notified HHS, and offered 12 months of credit monitoring via IDX.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 27 weeks / 187 days

Apr 16, 2026

Begins

Apr 17, 2026

Discovered

Oct 21, 2026

Filed

vs. sector median

+18 wks slower

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Vermont State AGbd_e2a16e62d42c7f312026-10-21Candidate

Name: Ohio Living
norm: ohio living

Name: Ohio Living
norm: ohio living
Industry: Healthcarellm

Discovered: Apr 17, 2026
Breach occurred: Apr 16, 2026 – Apr 17, 2026
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Jun 12, 2026
Affected individuals: 6state-resident count only
Data types: Identity (basic)Government IDPHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified the U.S. Department of Health and Human ServicesProvided supplemental notice to the U.S. Department of Health and Human ServicesProvided written notice to other state regulators as required

During the incident: Launched an investigation with the assistance of third-party cyber security specialists
Notified potentially affected individuals via website and media notice
Performed a time-intensive third-party review of the impacted files
Undertook a detailed internal review of its records to identify contact information
Notified the U.S. Department of Health and Human Services
Provided access to credit monitoring and identity restoration services for twelve (12) months, through IDX
Established a toll-free assistance line
Provided potentially affected individuals with guidance on how to better protect against identity theft and fraud
Provided supplemental notice to the U.S. Department of Health and Human Services
Provided written notice to other state regulators as required
Provided notice to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Changes made: Taken steps to further strengthen its information technology environment to protect against cybersecurity events
Continues to implement additional technical controls and administrative safeguards
Providing cybersecurity training to its employees
Reviewed its policies, procedures, and processes to reduce the likelihood of a similar future event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 weeks(187 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Vermont State AGOct 21 · first

New Hampshire State AGOct 21 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ohio-living-20261021.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 21, 2026
Raw hash: de416586ab6ce9026821152b4c3deedf67134f0e85344c675726b991cbdccc10

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityOhio Living

Victim entityOhio Living

Incidentdiscovered Apr 17, 2026

Stated responseLaunched an investigation with the assistance of third-party cyber security specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov