MalwareHealthcareHealthcareRansomwareStolen CredentialsData ExfiltratedData PublishedData EncryptedEmployee Data InvolvedRansom DemandedIdentity (basic)Government IDEmploymentFinancial accountHealth (basic)MediumContained

Neopharm Labs

bd_a73053d65b6ec913 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Jul 15, 2026

Filed

Sep 1, 2026

To disclose

—

Affected

6state residents only

Linked

2 records

Confidence

69%

Full breach record for Neopharm Labs →

Neopharm Labs Inc experienced a ransomware attack on July 15, 2026, resulting in data exfiltration and publication. Subsequently, from August 1-10, 2026, HR files were accessible internally without restrictions. Affected employee data includes PII, government IDs, employment, financial, and health information. The company contained the incident, reset credentials, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Jul 15, 2026

Begins

Jul 15, 2026

Discovered

Sep 1, 2026

Filed

This filing is one of 2 records about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitechaosbd_89baffffcf4adc252026-07-22 · +41dCandidate

Name: Neopharm Labs
norm: neopharm labs
Domain: neopharmlabs.com

Name: Neopharm Labs
norm: neopharm labs
Domain: neopharmlabs.com
Industry: Healthcarellm

Discovered: Jul 15, 2026
Breach occurred: Jul 15, 2026 – Aug 10, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 31, 2026
Affected individuals: 6state-resident count only
Data types: Identity (basic)Government IDEmploymentFinancial accountHealth (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1078 Valid Accounts
Threat actor: ExternalFinancial

During the incident: Immediate isolation of affected systems to contain the incident
Engagement of specialized cybersecurity firms to conduct the investigation and system restoration
Reset of compromised credentials
Implementation of enhanced infrastructure monitoring
Re-implementation of internal permission to access files
Engagement of external legal counsel to support the notification and compliance process
Commencement of a data mining exercise to comprehensively identify the information involved
Changes made: Offering 24-month subscription to myTrueIdentity credit monitoring and identity restoration service
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1673-neopharm-labs-inc/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 1, 2026
Raw hash: 917a0fd74821f04529b0dc92c5017ce201f1a2ff188e7fa1d54894ad8338e901

Linked disclosures

Ransomware claims (1)

Reporting entityNeopharm Labs

Victim entityNeopharm Labs

Incidentdiscovered Jul 15, 2026

Stated responseImmediate isolation of affected systems to contain the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov