HackingHealthcareProfessional ServicesHealthcareVulnerability ExploitSupply Chain (3P Vendor)Customer Data InvolvedMulti-Stage ChainPIIIdentity (basic)LowContained

The Gladney Center for Adoption

bd_5d234d2bfc0ac1ca · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 1, 2025

Filed

Feb 9, 2026

To disclose

12 months

Affected

Not disclosed

Linked

8 filings

Confidence

64%

Full breach record for The Gladney Center for Adoption →

The Gladney Center for Adoption experienced two security incidents in 2025. The first occurred in or about February 2025 impacting a portion of the network. A second incident related to a third-party system vulnerability occurred in or about April 2025, impacting the same network section. The organization engaged external cybersecurity professionals and notified federal law enforcement. On January 23, 2026, the organization determined that certain files containing personal information may have been subject to unauthorized access. Affected individuals are offered 24 months of identity monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Massachusetts clock✗ MA AG >90d12 months discovery → filing

Incident timeline

discovery → filing · 12 months / 373 days

Feb 1, 2025

Begins

Feb 1, 2025

Discovered

Feb 9, 2026

Filed

vs. sector median

+42 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Texas State AGbd_1ddc7cc07cab79bf2026-02-06 · +3dVerified
New Hampshire State AGbd_36de3c5e0c9276352026-02-06 · +3dVerified
Maine State AGbd_5dbfd77f0c86a22f2026-02-06 · +3dVerified
Indiana State AGbd_3808790bfc36f40b2026-02-03 · +6dCandidate

Show 3 more filings ↓up to 6d gap

Nebraska State AGbd_3f9a6e198c38e1802026-02-03 · +6dVerified
Indiana State AGbd_a6c9b3e81c3307a02026-02-03 · +6dCandidate
Vermont State AGbd_ecdeaca458829da42026-02-03 · +6dVerified

Name: The Gladney Center for Adoption
norm: the gladney center for adoption
Domain: mygladney.com

Name: The Gladney Center for Adoption
norm: the gladney center for adoption
Domain: mygladney.com
Industry: HealthcarellmProfessional Servicesllm

Discovered: Feb 1, 2025
Breach occurred: Feb 1, 2025 – Apr 30, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 3, 2026
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified federal law enforcement
Initial access: supply_chain

During the incident: Commenced a prompt and thorough investigation separately for each incident
Worked closely with external cybersecurity professionals
Notified federal law enforcement of the incidents
Reviewed existing policies and training protocols relating to data protection
Enhanced security measures and monitoring tools
Switched out systems that no longer serve their purpose
Provided complimentary access to identity monitoring for 24 months provided by Kroll
Set up a dedicated and confidential toll-free response line
Changes made: Enhanced security measures and monitoring tools
Switched out systems that no longer serve their purpose
Continually evaluate and modify practices and internal controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 months(373 days from discovery to filing)
Compliance flags: MA AG >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

Indiana State AGFeb 3 · first

Nebraska State AGFeb 3 · first

Indiana State AGFeb 3 · first

Vermont State AGFeb 3 · first

Texas State AG+3d

New Hampshire State AG+3d

Maine State AG+3d

Massachusetts State AG+6d · this page

Pattern: first filing Feb 3 (IN), last Feb 9 (MA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-195-the-gladney-center-for-adoption/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 9, 2026
Raw hash: e5c75c9d7a0bb9e1c30fe70459d350e76c2ad63e1c2559e57b5327cd145772da

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityThe Gladney Center for Adoption

Victim entityThe Gladney Center for Adoption

Incidentdiscovered Feb 1, 2025

Stated responseCommenced a prompt and thorough investigation separately for each incident

ComplianceMA AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov