MisusePrivilege AbuseEmployee Data InvolvedTargetedIDENTITY_GOVERNMENTIDENTITY_BASICPHIMediumContained
Baystate Noble Hospital
bd_ba723e7502785cb0 · schema v1 · pii pii-v1
Full breach record for Baystate Noble Hospital →Baystate Noble Hospital, a subsidiary of Baystate Health, notified patients in Massachusetts of an insider incident on April 14, 2026. An employee took copies of out-of-state driver's licenses and health insurance cards off hospital property without legitimate business reason. The hospital retrieved the documents, took corrective action against the employee, and offered two years of Experian IdentityWorks credit monitoring to affected individuals. No clinical or treatment information was compromised.
Massachusetts clock⏱ MA AG >30d7 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://www.mass.gov/doc/2026-951-baystate-noble-hospital/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 1, 2026
- Raw hash
- 5badd31a3023daafcb81ed6c688850c0e734d7e0f809b9383e2c6a22bc04463e
Reporting entity
- Name
- BAYSTATE HEALTH, INC.norm: baystate health
Victim entity
- Name
- Baystate Noble Hospitalnorm: baystate noble hospital
Incident
- Discovered
- Apr 14, 2026
- Materiality determined
- —
- Notification sent
- Jun 3, 2026
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASICPHI
- Attack vector
- Insider
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- Internal
- Initial access
- insider_action
Compliance
- Time to disclose
- 7 weeks(48 days from discovery to filing)
- Compliance flags
- MA AG >30d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.