HackingHealthcareProfessional ServicesHealthcareVulnerability ExploitSupply Chain (3P Vendor)Customer Data InvolvedMulti-Stage ChainHealth (basic)Identity (basic)Government IDPIIMediumContained

The Gladney Center for Adoption

bd_5d234d2bfc0ac1ca · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Feb 9, 2026

To disclose

—

Affected

28state residents only

Linked

8 filings

Confidence

64%

Full breach record for The Gladney Center for Adoption →

The Gladney Center for Adoption experienced two security incidents in 2025. The first occurred in or about February 2025 impacting a portion of the network. A second incident related to a third-party system vulnerability occurred in or about April 2025, impacting the same network section. The organization engaged external cybersecurity professionals and notified federal law enforcement. On January 23, 2026, the organization determined that certain files containing personal information may have been subject to unauthorized access. Affected individuals are offered 24 months of identity monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 1, 2025

Begins

Feb 9, 2026

Filed

This filing is one of 8 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Texas State AGbd_1ddc7cc07cab79bf2026-02-06 · +3dVerified
New Hampshire State AGbd_36de3c5e0c9276352026-02-06 · +3dVerified
Maine State AGbd_5dbfd77f0c86a22f2026-02-06 · +3dVerified
Indiana State AGbd_3808790bfc36f40b2026-02-03 · +6dCandidate

Show 3 more filings ↓up to 6d gap

Nebraska State AGbd_3f9a6e198c38e1802026-02-03 · +6dVerified
Indiana State AGbd_a6c9b3e81c3307a02026-02-03 · +6dCandidate
Vermont State AGbd_ecdeaca458829da42026-02-03 · +6dVerified

Name: The Gladney Center for Adoption
norm: the gladney center for adoption
Domain: mygladney.com

Name: The Gladney Center for Adoption
norm: the gladney center for adoption
Domain: mygladney.com
Industry: HealthcarellmProfessional Servicesllm

Discovered: —
Breach occurred: Feb 1, 2025 – Apr 30, 2025
Materiality determined: —
Notification sent: Feb 3, 2026
Affected individuals: 28state-resident count only
Data types: Health (basic)Identity (basic)Government IDPII
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified federal law enforcement
Initial access: supply_chain

During the incident: Commenced a prompt and thorough investigation separately for each incident
Worked closely with external cybersecurity professionals
Notified federal law enforcement of the incidents
Reviewed existing policies and training protocols relating to data protection
Enhanced security measures and monitoring tools
Switched out systems that no longer serve their purpose
Provided complimentary access to identity monitoring for 24 months provided by Kroll
Set up a dedicated and confidential toll-free response line
Changes made: Enhanced security measures and monitoring tools
Switched out systems that no longer serve their purpose
Continually evaluate and modify practices and internal controls
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

Indiana State AGFeb 3 · first

Nebraska State AGFeb 3 · first

Indiana State AGFeb 3 · first

Vermont State AGFeb 3 · first

Texas State AG+3d

New Hampshire State AG+3d

Maine State AG+3d

Massachusetts State AG+6d · this page

Pattern: first filing Feb 3 (IN), last Feb 9 (MA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-195-the-gladney-center-for-adoption/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 9, 2026
Raw hash: e5c75c9d7a0bb9e1c30fe70459d350e76c2ad63e1c2559e57b5327cd145772da

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityThe Gladney Center for Adoption

Victim entityThe Gladney Center for Adoption

IncidentThird-Party / Supply Chain

Stated responseCommenced a prompt and thorough investigation separately for each incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov