HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedData ExfiltratedHealth (basic)Identity (basic)Government IDPHIMediumContained

Texas Medicaid and Healthcare Partnership

bd_61958284ae375148 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 20, 2026

Filed

Jun 19, 2026

To disclose

9 weeks

Affected

1state residents only

Linked

5 filings

Confidence

65%

Full breach record for Texas Medicaid and Healthcare Partnership →

Texas Medicaid & Healthcare Partnership (TMHP) notified individuals that unknown persons accessed their data between February 5, 2026, and March 26, 2026. TMHP discovered the breach on April 20, 2026. Affected data includes names, SSNs, DOBs, Medicaid numbers, and health information. TMHP revoked unauthorized access, blocked suspicious IPs, and offered 12 months of credit monitoring via IDX.

J jump to incidentP pin to compareR raw source

Massachusetts clock⏱ MA AG >30d9 weeks discovery → filing

Incident timeline

undetected · 74 days

discovery → filing · 9 weeks / 60 days

Feb 5, 2026

Begins

Apr 20, 2026

Discovered

Jun 19, 2026

Filed

vs. sector median

on median

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

HHS OCRbd_18ceb9925f8cb23b2026-06-19Verified
New Hampshire State AGbd_9e26364f9a6fad2a2026-06-19Verified
Texas State AGbd_906bae13578207a82026-06-22 · +3dVerified
Texas State AGbd_f60f2a30e7050a922026-05-22 · +28dCandidate

Name: Texas Medicaid and Healthcare Partnership
norm: texas medicaid and healthcare partnership
Domain: tmhp.com

Name: Texas Medicaid and Healthcare Partnership
norm: texas medicaid and healthcare partnership
Domain: tmhp.com
Industry: Healthcarellm

Discovered: Apr 20, 2026
Breach occurred: Feb 5, 2026 – Mar 26, 2026
Undetected for: 74 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 18, 2026
Affected individuals: 1state-resident count only
Data types: Health (basic)Identity (basic)Government IDPHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Quickly turned off the access used by the unknown person or people
Blocked internet connections from suspicious locations (IP addresses)
Checked the accounts and records that may have been affected
Restored access after confirming the correct email addresses with users
Began a full review and made improvements to help stop this from happening again
Offered free identity theft protection services through IDX
Changes made: Made improvements to help stop this from happening again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: MA AG >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 3 states

View merged incident ↗

Texas State AGMay 22 · first

HHS OCR+28d

New Hampshire State AG+28d

Massachusetts State AG+28d · this page

Texas State AG+31d

Pattern: first filing May 22 (TX), last Jun 22 (TX) — a 31-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1004-texas-medicaid-and-healthcare-partnership/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 19, 2026
Raw hash: 3fb81d435dd0a80258110cb9635f1d9a5480a5a4da88b86a2f375bdeee298c4d

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityTexas Medicaid and Healthcare Partnership

Victim entityTexas Medicaid and Healthcare Partnership

Incidentdiscovered Apr 20, 2026

Stated responseQuickly turned off the access used by the unknown person or people

ComplianceMA AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov