Social EngineeringHealthcareHealthcarePhishingData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)MediumContained

Fyzical Acquisition Holdings, LLC

bd_6417337e214eaab7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 9, 2024

Filed

Dec 19, 2025

To disclose

13 months

Affected

6state residents only

Confidence

67%

Full breach record for Fyzical Acquisition Holdings, LLC →3 incidents on file

Fyzical Acquisition Holdings, LLC, a physical therapy franchisor, notified the New Hampshire Attorney General of a data event affecting 6 NH residents. The breach involved unauthorized access to email data via phishing, exposing names, DOB, SSNs, financial account info, and PHI. Notification letters were mailed on Dec 19, 2025. Fyzical engaged forensic investigators and offered credit monitoring and identity theft recovery services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 13 months / 375 days

Dec 9, 2024

Discovered

Dec 19, 2025

Filed

vs. sector median

+41 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed6 affectedView incident

Name: Fyzical Acquisition Holdings, LLC
norm: fyzical acquisition

Name: Fyzical Acquisition Holdings, LLC
norm: fyzical acquisition
Industry: Healthcarellm

Discovered: Dec 9, 2024
Materiality determined: —
Notification sent: Dec 19, 2025
Affected individuals: 6state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General's Office
Initial access: phishing_link

During the incident: Engaged a specialized cybersecurity firm to conduct a forensic investigation
Informed its law firm
Began identifying the affected individuals in preparation for notice
Offered at least 12 months of complimentary credit and CyberScan monitoring
Offered a $1,000,000 insurance reimbursement policy
Offered fully managed id theft recovery services through IDX Identity
Changes made: Provided guidance on how to better protect against identity theft and fraud
Provided information on how to place a fraud alert and security freeze on one’s credit file
Provided contact details for the national consumer reporting agencies
Provided information on how to obtain a free credit report
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 months(375 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/fyzical-acquisition-20251219.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 19, 2025
Raw hash: 5a219e05498a41bfde0a9b418f75ecd166cecdf9924e5728c0ea67c152b5dd76

Reporting entityFyzical Acquisition Holdings, LLC

Victim entityFyzical Acquisition Holdings, LLC

Incidentdiscovered Dec 9, 2024

Stated responseEngaged a specialized cybersecurity firm to conduct a forensic investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov