Social EngineeringPhishingCustomer Data InvolvedIDENTITY_BASICPHIHEALTH_BASICLowContained
Cunningham Prosthetic Care, LLC
bd_7471696c7f083d56 · schema v1 · pii pii-v1
Full breach record for Cunningham Prosthetic Care, LLC →Cunningham Prosthetic Care, LLC notified Massachusetts and Rhode Island residents of a data security incident occurring on or about October 22, 2025. An unauthorized individual accessed a company email account, potentially exposing personal and protected health information (names, PHI). The company engaged external cybersecurity professionals, determined the scope on March 4, 2026, and offered 24 months of complimentary credit monitoring and fraud assistance via Cyberscout/TransUnion. No evidence of fraud was found.
Massachusetts clock✗ MA AG >90d27 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_9657f174fcaf0491HHS OCRfiled 2026-05-01Verified
Source provenance
- Source URL
- https://www.mass.gov/doc/2026-679-cunningham-prosthetic-care-llc/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 1, 2026
- Raw hash
- 930fde1f2d9c8edf915086a5cacca74a86f352f87fa4376ea9860366081fe8fc
Reporting entity
- Name
- Cunningham Prosthetic Care, LLCnorm: cunningham prosthetic care
Victim entity
- Name
- Cunningham Prosthetic Care, LLCnorm: cunningham prosthetic care
Incident
- Discovered
- Oct 22, 2025
- Materiality determined
- —
- Notification sent
- May 1, 2026
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICPHIHEALTH_BASIC
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing Link
- Threat actor
- External
- Initial access
- phishing_link
Compliance
- Time to disclose
- 27 weeks(191 days from discovery to filing)
- Compliance flags
- MA AG >90d
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.