HackingHealthcareHealthcareData MishandlingSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedDelayed DiscoveryHealth (basic)Identity (basic)Government IDMediumContained

ELARA CARING

bd_7bf06e69b1fa254f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 12, 2026

Filed

May 12, 2026

To disclose

9 weeks

Affected

714state residents only

Linked

3 filings

Confidence

64%

Full breach record for ELARA CARING →3 incidents on file

Elara Caring notified Massachusetts residents of a data security incident involving a third-party vendor. Between November 4-6 and November 14-17, 2025, an unauthorized actor accessed patient documents containing personal information, including Social Security numbers. Elara terminated the vendor relationship, conducted a security review, and provided 24 months of complimentary credit monitoring via Cyberscout/TransUnion. The incident was discovered in March 2026, with notifications sent in May 2026.

J jump to incidentP pin to compareR raw source

Massachusetts clock⏱ MA AG >30d9 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 128 days

discovery → filing · 9 weeks / 61 days

Nov 4, 2025

Begins

Mar 12, 2026

Discovered

May 12, 2026

Filed

vs. sector median

4 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_cf4d884363280d302026-05-12Verified
Texas State AGbd_8f9a1c733571d4e42026-05-14 · +2dVerified

Name: ELARA CARING
norm: elara caring

Name: ELARA CARING
norm: elara caring
Industry: Healthcarellm

Discovered: Mar 12, 2026
Breach occurred: Nov 4, 2025 – Nov 17, 2025
Undetected for: 128 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 12, 2026
Affected individuals: 714state-resident count only
Data types: Health (basic)Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Initial access: supply_chain

During the incident: Terminated its relationship with this third-party vendor
Conducting a thorough review of its information security policies, procedures, and controls, including those related to third-party vendors
Implementing appropriate enhancements to reduce the risk of a similar incident from occurring in the future
Providing access to complimentary credit monitoring and remediation services through Cyberscout, a TransUnion company, for 24 months
Changes made: Conducting a thorough review of its information security policies, procedures, and controls, including those related to third-party vendors
Implementing appropriate enhancements to reduce the risk of a similar incident from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(61 days from discovery to filing)
Compliance flags: MA AG >30d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

HHS OCRMay 12 · first

Massachusetts State AGMay 12 · first · this page

Texas State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-769-elara-caring/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 12, 2026
Raw hash: a7f096c79e005e6e45b926abec5c2535286865b89a476d3c4230d5696978d53f

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityELARA CARING

Victim entityELARA CARING

Incidentdiscovered Mar 12, 2026

Stated responseTerminated its relationship with this third-party vendor

ComplianceMA AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov