HackingHealthcareHealthcareSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)LowContained

North East Medical Services Foundation

bd_8f92823183511bb7 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 19, 2025

Filed

Feb 18, 2026

To disclose

17 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for North East Medical Services Foundation →2 incidents on file

North East Medical Services detected unauthorized access to data on its third-party managed service provider, United Layer, on October 19, 2025. The investigation confirmed that certain individuals' first and last names may have been accessed. NEMS engaged forensic specialists, secured its environment, and is offering complimentary credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 17 weeks / 122 days

Oct 19, 2025

Begins

Oct 19, 2025

Discovered

Feb 18, 2026

Filed

vs. sector median

+5 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_2f886d386697a6462026-02-19 · +1dVerified
HHS OCRbd_ecbbe66c18d133bd2025-12-18 · +62dVerified

Name: North East Medical Services Foundation
norm: north east medical

Name: North East Medical Services Foundation
norm: north east medical
Industry: Healthcarellm

Discovered: Oct 19, 2025
Breach occurred: Oct 19, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Third party: via United Layer
Initial access: supply_chain

During the incident: Took steps to secure its environment
Conducted a comprehensive investigation
Engaged third-party forensic specialists
Reviewed potentially impacted information to assess potential notification obligations
Offering complimentary credit monitoring through Cyberscout
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(122 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

HHS OCRDec 18 · first

California State AG+62d · this page

Massachusetts State AG+63d

Pattern: first filing Dec 18 (CA), last Feb 19 (MA) — a 63-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-618957
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 18, 2026
Raw hash: 94cc3f842093cd59fe4687cfbc86f2d0c161a86bb0ef6a59cf1c2132996b62bb

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityNorth East Medical Services Foundation

Victim entityNorth East Medical Services Foundation

Incidentdiscovered Oct 19, 2025

Stated responseTook steps to secure its environment

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov