DisclosureLens
Social EngineeringHealthcareProfessional ServicesHealthcarePhishingStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancialPHIHealth (basic)MediumContained

Gateways Community Services

bd_c2255502d4c6cffc · schema v1 · pii pii-v2

Severity

Medium

Discovered

Feb 2, 2026

Filed

Sep 23, 2026

To disclose

33 weeks

Affected

627state residents only

Confidence

66%
Full breach record for Gateways Community Services →2 incidents on file

Gateways Community Services, a nonprofit providing home and community-based services, experienced a cybersecurity incident involving phishing. On February 2, 2026, suspicious activity was discovered in an employee's email account. Forensic investigation revealed that email accounts were compromised via phishing between November 12, 2025, and January 21, 2026, resulting in unauthorized access to files containing personal information. Gateways notified 627 New Hampshire residents and an additional 134 Maine residents. Affected data included names, dates of birth, Medicaid IDs, financial information, and medical records. The organization secured the accounts, engaged forensic experts, and offered credit monitoring.

Incident timeline

undetected · 82 days
discovery → filing · 33 weeks / 233 days

Nov 12, 2025

Begins

Feb 2, 2026

Discovered

Sep 23, 2026

Filed

vs. sector median

+24 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed627 affectedView incident

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.