MisuseHealthcareHealthcarePrivilege AbuseCustomer Data InvolvedPHIHealth (basic)Identity (basic)LowContained

Modern Health

bd_7811b1c9224e56b0 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 1, 2025

Filed

Jan 16, 2026

To disclose

11 weeks

Affected

2state residents only

Confidence

66%

Full breach record for Modern Health →

Modern Health notified Massachusetts residents of a data security incident beginning in November 2025, where an unauthorized individual within its provider network accessed a limited number of member profiles on its behavioral health platform. The incident involved potential unauthorized access to personal and health information, though Social Security Numbers and financial information were not impacted. Modern Health disabled the affected profiles, conducted an internal investigation, engaged legal counsel, and enhanced provider-vetting policies. No specific count of affected individuals was disclosed.

J jump to incidentP pin to compareR raw source

Massachusetts clock⏱ MA AG >30d11 weeks discovery → filing

Incident timeline

discovery → filing · 11 weeks / 76 days

Nov 1, 2025

Discovered

Jan 16, 2026

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Name: The Modern
norm: the modern
Domain: themodernnyc.com

Name: Modern Health
norm: modern health
Domain: my.joinmodernhealth.com
Industry: Healthcarellm

Discovered: Nov 1, 2025
Materiality determined: —
Notification sent: Jan 12, 2026
Affected individuals: 2state-resident count only
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Initial access: insider_action

During the incident: Disabled the affected profiles
Conducted an internal investigation
Engaged legal counsel
Assessed the security of its systems
Notified potentially affected individuals
Changes made: Enhanced its onboarding and provider-vetting policies and processes
Provided additional training to staff
Will continue to evaluate and improve its safeguards on an ongoing basis
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(76 days from discovery to filing)
Compliance flags: MA AG >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-73-modern-health/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 16, 2026
Raw hash: d7b01363d600cfcb032f7452503f97193ccb6ba476cd2fed9d96c3f1b7c849b3

Reporting entityThe Modern

Victim entityModern Health

Incidentdiscovered Nov 1, 2025

Stated responseDisabled the affected profiles

ComplianceMA AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov