HackingHealthcareHealthcareStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDPHIHealth (basic)MediumContained

Elevate Health and Rehabilitation

bd_906f0dd3259744eb · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 1, 2026

Filed

Aug 10, 2026

To disclose

10 weeks

Affected

1state residents only

Confidence

64%

Full breach record for Elevate Health and Rehabilitation →

Elevate Health and Rehabilitation notified residents of a data breach involving a third-party vendor. An unauthorized actor used stolen credentials to access and copy resident records between November 25-28, 2025. The incident was discovered on June 1, 2026. Affected data included names, SSNs, driver's licenses, and health information. The company engaged cybersecurity experts, contacted the FBI, and offered identity protection services.

J jump to incidentP pin to compareR raw source

Massachusetts clock⏱ MA AG >30d10 weeks discovery → filing

Incident timeline

undetected · 188 days

discovery → filing · 10 weeks / 70 days

Nov 25, 2025

Begins

Jun 1, 2026

Discovered

Aug 10, 2026

Filed

vs. sector median

3 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Elevate Health and Rehabilitation
norm: elevate health and rehabilitation

Name: Elevate Health and Rehabilitation
norm: elevate health and rehabilitation
Industry: Healthcarellm

Discovered: Jun 1, 2026
Breach occurred: Nov 25, 2025 – Nov 28, 2025
Undetected for: 188 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 31, 2026
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDPHIHealth (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Contacted the FBI
Third party: via trusted vendor
Initial access: valid_credentials

During the incident: Engaged a specialized cybersecurity vendor to assist
Contacted the FBI
Disabled compromised credentials
Reset passwords
Secured access to the files stored in our vendor’s system
Changes made: Enhancing the safeguards that support our systems
Implementing additional layers of safeguards designed to further strengthen how we protect your information
Offering identity theft protection services through IDX
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(70 days from discovery to filing)
Compliance flags: MA AG >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1326-asheville-victoria-nc-opco-llc-dba-elevate-health-rehabilitation/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 10, 2026
Raw hash: 33dd16f0b54ad56831e18273d0632fbe0a74e4f03f04d2bb4d434bac6bddbd10

Reporting entityElevate Health and Rehabilitation

Victim entityElevate Health and Rehabilitation

Incidentdiscovered Jun 1, 2026

Stated responseEngaged a specialized cybersecurity vendor to assist

ComplianceMA AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov