Social EngineeringHealthcareHealthcarePhishingCustomer Data InvolvedIdentity (basic)PIILowContained

Park West Psychology

bd_8d47f6c48d273e98 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 15, 2026

Filed

Jul 10, 2026

To disclose

25 days

Affected

13state residents only

Confidence

66%

Full breach record for Park West Psychology →

Park West Psychology notified Massachusetts and New York residents of a privacy incident on July 6, 2026. An unauthorized actor accessed the provider's Google Workspace/Gmail account via a phishing/device-prompt attack on June 15, 2026. The actor exported Google Contacts, resulting in the exposure of client names and email addresses. No clinical records, SSNs, or financial data were compromised. The provider contained the account, reset credentials, and engaged legal counsel.

J jump to incidentP pin to compareR raw source

Massachusetts clock✓ MA AG ≤30d25 days discovery → filing

Incident timeline

discovery → filing · 25 days

Jun 15, 2026

Discovered

Jul 10, 2026

Filed

vs. sector median

9 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed13 affectedView incident

Name: Park West Psychology
norm: park west psychology
Domain: parkwestpsychology.com

Name: Park West Psychology
norm: park west psychology
Domain: parkwestpsychology.com
Industry: Healthcarellm

Discovered: Jun 15, 2026
Materiality determined: —
Notification sent: Jul 6, 2026
Affected individuals: 13state-resident count only
Data types: Identity (basic)PII
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Initial access: phishing_link

During the incident: Changed account credentials
Reset active sign-in sessions
Blocked and removed the unauthorized device
Disabled POP/IMAP access
Reviewed third-party app/OAuth access
Reviewed Gmail settings
Preserved logs and evidence
Reviewed Google Workspace logs for Gmail, Contacts, Drive, Calendar, Admin, Takeout, Data Migration, SAML, and related activity
Consulted legal counsel regarding notification obligations
Changes made: Secured the account
Investigated the incident
Preserved evidence
Reduced the risk of the incident recurring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 days(25 days from discovery to filing)
Compliance flags: MA AG ≤30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1107-park-west-psychology/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 10, 2026
Raw hash: e22f7a1240324c2b72af3db6ba4377ba411840a622ce91acc77a787402701dba

Reporting entityPark West Psychology

Victim entityPark West Psychology

Incidentdiscovered Jun 15, 2026

Stated responseChanged account credentials

ComplianceMA AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov