HackingHealthcareHealthcarePhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHighContained

Andover Eye Associates

bd_5541a942b8c8518a · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 10, 2025

Filed

Dec 31, 2025

To disclose

29 weeks

Affected · nationwide

1,6387 in this filing

Linked

4 filings

Confidence

66%

Full breach record for Andover Eye Associates →2 incidents on file

Andover Eye Associates reported a data breach affecting 1,638 individuals, including 7 Maine residents. Unauthorized access to employee email accounts occurred on May 28, 2025, after suspicious activity was detected on June 10, 2025. The incident involved the exposure of names and Social Security numbers. The company notified law enforcement, HHS, and affected individuals, offering one year of credit monitoring through Epiq.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jun 10, 2025 → Filed with AG Dec 31, 2025204d ✗ ME AG >90d29 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 13 days

discovery → filing · 29 weeks / 204 days

May 28, 2025

Begins

Jun 10, 2025

Discovered

Dec 31, 2025

Filed

vs. sector median

+17 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

HHS OCRbd_42975ea933d98fd92025-12-31Verified
New Hampshire State AGbd_4f03df84f95f375f2025-12-31Verified
Massachusetts State AGbd_902a2ab894e534d82025-12-31Verified

Name: Andover Eye Associates
norm: andover eye associates
Domain: andovereyeinstitute.com
Industry: Healthcare

Name: Andover Eye Associates
norm: andover eye associates
Domain: andovereyeinstitute.com
Industry: Healthcare
Industry: Healthcarellm

Discovered: Jun 10, 2025
Breach occurred: May 28, 2025
Undetected for: 13 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 31, 2025
Affected individuals: 1,638state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcementNotifying the U.S. Department of Health and Human Services
Initial access: phishing_link

During the incident: Launched an investigation to determine the nature and scope of the activity
Undertook a detailed review of all emails potentially impacted
Notified federal law enforcement regarding the event
Providing access to credit monitoring services for one (1) year, through Epiq Global
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Notifying the U.S. Department of Health and Human Services
Notifying prominent media pursuant to HIPAA
Changes made: Working to implement additional safeguards and training to its employees
Continues to evaluate its policies and procedures related to data privacy and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 weeks(204 days from discovery to filing)
Compliance flags: ME AG >90d · 204dME resident >60d · 204d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jun 10, 2025
→ Filed with AG: Dec 31, 2025
204d 90 days ME AG >90d
Maine
Discovered: Jun 10, 2025
→ Notified: Dec 31, 2025
204d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jun 10, 2025 → Filed with AG: Dec 31, 2025	204d	90 days	ME AG >90d
Maine	Discovered: Jun 10, 2025 → Notified: Dec 31, 2025	204d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

HHS OCRDec 31 · first

New Hampshire State AGDec 31 · first

Massachusetts State AGDec 31 · first

Maine State AGDec 31 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/030dba15-f58b-400d-9ffc-56012920694f.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 31, 2025
Raw hash: 0c6e4acf3b3fa54343851019474ee29b011abaafe7edeb165562670de643b939

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityAndover Eye Associates

Victim entityAndover Eye Associates

Incidentdiscovered Jun 10, 2025

Stated responseLaunched an investigation to determine the nature and scope of the activity

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov