HackingHealthcareHealthcareStolen CredentialsData ExfiltratedCustomer Data InvolvedBusiness Associate (HIPAA)Identity (basic)Government IDMediumContained

PRECIPIO, INC.

bd_558f09869d31cb76 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Apr 23, 2026

To disclose

—

Affected

3state residents only

Linked

6 filings

Confidence

66%

Full breach record for PRECIPIO, INC. →2 incidents on file

Precipio, Inc. notified the NH Attorney General of unauthorized access to a cloud-based storage account on or around November 23, 2025. Files were copied without authorization. The incident affected 3 New Hampshire residents, potentially exposing names and Social Security numbers. Precipio contained the incident, reset passwords, and is offering 12 months of credit monitoring. HHS was notified.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline

Nov 23, 2025

Begins

Apr 23, 2026

Filed

This filing is one of 6 about the same incident.View merged incident

A leak claim by inc_ransom about this victim predates this filing by 141 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteinc_ransombd_ae72dca75f4653fe2025-12-02 · +141dVerified by operator

Regulatory filings (4) · sorted by filing gap

Vermont State AGbd_be7b7a4cddb332072026-04-23Verified
Massachusetts State AGbd_faaa7d0419f32d3f2026-04-23Verified
Texas State AGbd_a516eef4774ddad82026-04-24 · +1dCandidate
Illinois State AGbd_941f9a2132834d822026-04-01 · +22dVerified

Name: PRECIPIO, INC.
norm: precipio
Domain: precipiodx.com

Name: PRECIPIO, INC.
norm: precipio
Domain: precipiodx.com
Industry: Healthcarellm

Discovered: —
Breach occurred: Nov 23, 2025
Materiality determined: —
Notification sent: Apr 23, 2026
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified the U.S. Department of Health and Human ServicesProviding written notice of this incident to relevant state regulators
Initial access: valid_credentials

During the incident: Took steps to contain the activity and reset the cloud-based storage account password
Initiated an investigation to confirm the full nature and scope of the activity
Undertook a comprehensive review of the files that may be affected
Notified federal law enforcement of the event
Providing access to credit monitoring services for twelve (12) months, through TransUnion
Providing written notice of this incident to relevant state regulators
Notifying the three major credit reporting agencies, Equifax, Experian, and TransUnion
Notifying the U.S. Department of Health and Human Services
Changes made: Will continue to evaluate and enhance its technical safeguards in the future
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >90d
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Illinois State AGApr 1 · first

Vermont State AG+22d

Massachusetts State AG+22d

New Hampshire State AG+22d · this page

Texas State AG+23d

Pattern: first filing Apr 1 (IL), last Apr 24 (TX) — a 23-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/precipio-20260423.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 23, 2026
Raw hash: 30efa0a3123217650056533559a617ce42c475359d0ad7ef8ad5b44b872601c9

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityPRECIPIO, INC.

Victim entityPRECIPIO, INC.

IncidentUnauthorized Access

Stated responseTook steps to contain the activity and reset the cloud-based storage account password

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov