Social EngineeringHealthcareHealthcarePhishingData ExfiltratedCustomer Data InvolvedIdentity (basic)Health (basic)LowContained

Springfield Hospital

bd_8aca0c9b10219526 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 10, 2026

Filed

Apr 14, 2026

To disclose

9 weeks

Affected

806state residents only

Linked

3 filings

Confidence

66%

Full breach record for Springfield Hospital →

Springfield Hospital notified the New Hampshire Attorney General on April 10, 2026, regarding unauthorized access to an employee email account on December 17, 2025. The incident affected 806 New Hampshire residents, exposing names, dates of birth, treatment reasons, and medical record numbers. The hospital secured the email tenant, investigated, and provided written notices with credit monitoring resources to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 55 days

discovery → filing · 9 weeks / 63 days

Dec 17, 2025

Begins

Feb 10, 2026

Discovered

Apr 14, 2026

Filed

vs. sector median

2 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_a3fe61f24669e9d42026-04-10 · +4dVerified
HHS OCRbd_b094034d49107dd42026-04-10 · +4dVerified

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: Springfield Hospital
norm: springfield hospital
Domain: springfieldhospital.org
Industry: Healthcarellm

Discovered: Feb 10, 2026
Breach occurred: Dec 17, 2025
Undetected for: 55 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 10, 2026
Affected individuals: 806state-resident count only
Data types: Identity (basic)Health (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External
Initial access: phishing_link

During the incident: Secured the email tenant
Commenced a prompt and thorough investigation
Providing the affected residents with written notice of this incident
Advising the affected residents about the process for placing fraud alerts and/or security freezes on their credit files and obtaining free credit reports
Providing the impacted residents with contact information for the consumer reporting agencies and the Federal Trade Commission
Established a dedicated and confidential toll-free response line
Changes made: Reviewed and revised our information security practices
Implemented additional security measures to mitigate the chance of a similar event in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(63 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGApr 10 · first

HHS OCRApr 10 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/springfield-hospital-20260414.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 14, 2026
Raw hash: ed245dbaa56f4f819783699d3a12ff911ac819f0eefa7b6a41a3e8c780b63852

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMCDONALD HOPKINS LLC

Victim entitySpringfield Hospital

Incidentdiscovered Feb 10, 2026

Stated responseSecured the email tenant

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov