HackingHealthcareHealthcareTargetedIdentity (basic)Government IDHealth (basic)MediumContained

Greater Pittsburgh Orthopedic Associates

bd_89ae0f264e159c03 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 10, 2025

Filed

Feb 20, 2026

To disclose

28 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

67%

Full breach record for Greater Pittsburgh Orthopedic Associates →4 incidents on file

Greater Pittsburgh Orthopedic Associates Inc. reported a data security incident detected on August 10, 2025, involving unauthorized access to its computer network. The breach potentially compromised patients' names, mailing addresses, Social Security numbers, and provider names. The organization engaged third-party forensic experts, secured its environment, notified law enforcement, and offered free credit monitoring services to affected individuals.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday28 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 28 weeks / 194 days

Aug 10, 2025

Discovered

Feb 20, 2026

Filed

vs. sector median

+15 wks slower

This filing is one of 3 about the same incident.View merged incident

A leak claim by ransomhouse about this victim predates this filing by 647 days.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_efe761f8ec18ada72026-02-20Candidate
Massachusetts State AGbd_8af8e0654a73318a2026-02-19 · +1dVerified

Name: Greater Pittsburgh Orthopedic Associates
norm: greater pittsburgh orthopedic associates
Domain: gpoa.com

Name: Greater Pittsburgh Orthopedic Associates
norm: greater pittsburgh orthopedic associates
Domain: gpoa.com
Industry: Healthcarellm

Discovered: Aug 10, 2025
Materiality determined: —
Notification sent: Feb 20, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: notified law enforcement regarding this incident
Initial access: exploit_public_facing

During the incident: Initiated its incident response
Engaged additional third-party experts
Commenced an investigation
Took steps to secure our environment
Hardened and enhanced our network security
Completed a digital forensic investigation
Notified law enforcement regarding this incident
Arranged for you to activate Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Changes made: Hardened and enhanced our network security
Continuous awareness training and assessment of our data security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(194 days from discovery to filing)
Compliance flags: VT AG >45 bdayLeak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGFeb 19 · first

Maine State AG+1d

Vermont State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2026-02-20-greater-pittsburgh-orthopedic-associates-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 20, 2026
Raw hash: 770e3631ae883e23efadb739c80f05746acc89b29c2f84df2555085944ab9b7a

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityGreater Pittsburgh Orthopedic Associates

Victim entityGreater Pittsburgh Orthopedic Associates

Incidentdiscovered Aug 10, 2025

Stated responseInitiated its incident response

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov