Social EngineeringHealthcareHealthcarePhishingMulti-Stage ChainWire FraudCustomer Data InvolvedEmployee Data InvolvedFinancial accountHealth (basic)Identity (basic)Government IDHighContained

ELARA CARING

bd_c64580c27c3d4666 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 11, 2026

Filed

Jun 24, 2026

To disclose

19 weeks

Affected

1,143state residents only

Linked

4 filings

Confidence

65%

Full breach record for ELARA CARING →3 incidents on file

Elara Caring notified Massachusetts residents of a data security incident involving unauthorized access to employee email accounts via phishing. The actor redirected employee paychecks and accessed patient files containing personal information. Elara terminated access, reset credentials, and engaged external experts. Affected data includes identity and financial information. No specific count was provided in this notice.

J jump to incidentP pin to compareR raw source

Massachusetts clock✗ MA AG >90d19 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 128 days

discovery → filing · 19 weeks / 133 days

Oct 6, 2025

Begins

Feb 11, 2026

Discovered

Jun 24, 2026

Filed

vs. sector median

+6 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Texas State AGbd_be7d391fb5a6fbfa2026-06-25 · +1dVerified
HHS OCRbd_38fb898212189fbe2026-06-23 · +1dVerified by operator
Illinois State AGbd_e4ed876fb16a4f132026-07-01 · +7dCandidate

Name: ELARA CARING
norm: elara caring

Name: ELARA CARING
norm: elara caring
Industry: Healthcarellm

Discovered: Feb 11, 2026
Breach occurred: Oct 6, 2025 – Feb 11, 2026
Undetected for: 128 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 23, 2026
Affected individuals: 1,143state-resident count only
Data types: Financial accountHealth (basic)Identity (basic)Government ID
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Terminated the unauthorized access to the employees’ accounts
Reset the employees’ credentials
Launched an investigation with the assistance of external cybersecurity experts
Changes made: Conducting a thorough review of our information security policies, procedures, and controls
Will implement appropriate enhancements to reduce the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(133 days from discovery to filing)
Compliance flags: MA AG >90d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

HHS OCRJun 23 · first

Massachusetts State AG+1d · this page

Texas State AG+2d

Illinois State AG+8d

Pattern: first filing Jun 23 (TX), last Jul 1 (IL) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1022-elara-caring/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 24, 2026
Raw hash: 017aabd86edb6c187889b709c7ad5996195a4cca1feb18b6859397b41370b6b4

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityELARA CARING

Victim entityELARA CARING

Incidentdiscovered Feb 11, 2026

Stated responseTerminated the unauthorized access to the employees’ accounts

ComplianceMA AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov