UnknownHealthcareHealthcareCustomer Data InvolvedEmployee Data InvolvedGovernment IDIdentity (basic)PHIHealth (basic)FinancialHighContained

Boston Health Care for the Homeless Program

bd_6af161e64d35340c · schema v1 · pii pii-v1

Severity

High

Discovered

Nov 11, 2025

Filed

Aug 7, 2026

To disclose

38 weeks

Affected

1,110state residents only

Linked

7 filings

Confidence

67%

Full breach record for Boston Health Care for the Homeless Program →6 incidents on file

Boston Health Care for the Homeless Program (BHCHP) notified the NH Attorney General of a data security incident. Unusual network activity was first detected on November 11, 2025. On June 8, 2026, BHCHP determined that personal information of patients and employees may have been accessed or acquired without authorization. Affected data may include Social Security numbers, driver's license numbers, medical information, and health insurance information. Approximately 1,110 New Hampshire residents were notified via mail on August 7, 2026. BHCHP engaged forensic experts, secured its network, and is offering 12 months of complimentary credit monitoring and identity protection services through TransUnion.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 38 weeks / 269 days

Nov 11, 2025

Discovered

Aug 7, 2026

Filed

vs. sector median

+26 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

California State AGbd_f23723729c9d0fa02026-08-07Verified
Massachusetts State AGbd_444eaa71b6dd171d2026-08-08 · +1dVerified
Vermont State AGbd_bd14e56de96b57652026-08-08 · +1dVerified
Texas State AGbd_343608a696f491232026-08-10 · +3dVerified

Show 2 more filings ↓up to 27d gap

HHS OCRbd_67134fcd82d661322026-08-10 · +3dVerified
Oregon State AGbd_e2fb0c5f42dfb4bc2026-09-03 · +27dVerified

Name: Boston Health Care for the Homeless Program
norm: boston health care for the homeless program

Name: Boston Health Care for the Homeless Program
norm: boston health care for the homeless program
Industry: Healthcarellm

Discovered: Nov 11, 2025
Materiality determined: —
Notification sent: Aug 7, 2026
Affected individuals: 1,110state-resident count only
Data types: Government IDIdentity (basic)PHIHealth (basic)Financial
Attack vector: Unknown
Regulator citations: Notified New Hampshire Attorney General

During the incident: Took immediate steps to secure its network
Launched an investigation with the assistance of a privileged digital forensics and incident response expert
Implemented additional safeguards to help ensure the security of its systems
Established a toll-free call center through TransUnion
Providing complimentary identity protection services, including 12 months of complimentary credit monitoring, to notified individuals
Providing individuals with guidance through TransUnion on how to better protect against identity theft and fraud
Providing individuals with information through TransUnion on how to place a fraud alert and security freeze on their credit file
Changes made: Implemented measures to enhance security and minimize the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 38 weeks(269 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 6 states

View merged incident ↗

California State AGAug 7 · first

New Hampshire State AGAug 7 · first · this page

Massachusetts State AG+1d

Vermont State AG+1d

Texas State AG+3d

HHS OCR+3d

Oregon State AG+27d

Pattern: first filing Aug 7 (CA), last Sep 3 (OR) — a 27-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/boston-health-care-homeless-program-20260807.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 7, 2026
Raw hash: 43d412ff314366fe4ae22fa94634e08c1b0092407a36f50d66f5500dab1261fe

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityBoston Health Care for the Homeless Program

Victim entityBoston Health Care for the Homeless Program

Incidentdiscovered Nov 11, 2025

Stated responseTook immediate steps to secure its network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov