HackingHealthcareProfessional ServicesHealthcareSupply Chain (3P Vendor)Data ExfiltratedPIIPHILowContained

KNIGHTS OF COLUMBUS

bd_cf4153e6766c775f · schema v1 · pii pii-v1

Severity

Low

Discovered

May 4, 2026

Filed

Aug 3, 2026

To disclose

13 weeks

Affected

5state residents only

Linked

4 filings

Confidence

68%

Full breach record for KNIGHTS OF COLUMBUS →2 incidents on file

AutoAPS, LLC, a third-party medical record retrieval vendor for Knights of Columbus, notified the organization on May 4, 2026, of suspicious activity detected in its hosting network on December 25, 2025. A forensic investigation could not confirm if data was accessed. The notification letter, filed with the Massachusetts Attorney General, offers IDX identity protection services to affected individuals, implying potential exposure of PII and PHI. The incident is classified as a third-party supply chain compromise.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 130 days

discovery → filing · 13 weeks / 91 days

Dec 25, 2025

Begins

May 4, 2026

Discovered

Aug 3, 2026

Filed

vs. sector median

+4 wks slower

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

New Hampshire State AGbd_e802c7cf47af73c72026-08-10 · +7dVerified
Nebraska State AGbd_2a9c65bd7e22a8c62026-07-10 · +24dCandidate
Indiana State AGbd_6381af49b9d370a22026-07-10 · +24dVerified

Name: AutoAPS, LLC
norm: autoaps

Name: KNIGHTS OF COLUMBUS
norm: knights of columbus
Industry: HealthcarellmProfessional Servicesllm

Discovered: May 4, 2026
Breach occurred: Dec 25, 2025
Undetected for: 130 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 5state-resident count only
Data types: PIIPHI
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: Partner
Initial access: supply_chain

During the incident: Vendor reported suspicious activity immediately
Vendor took steps to contain and remediate the incident
Forensic investigation initiated with assistance of a cybersecurity firm
Comprehensive review and analysis of data present in the environment
Offering a complimentary membership to identity protection services through IDX
Adopting additional safeguards to strengthen security
Implementing various hardening measures
Increasing access controls
Changes made: Implementing various hardening measures
Increasing access controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(89 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Nebraska State AGJul 10 · first

Indiana State AGJul 10 · first

Massachusetts State AG+24d · this page

New Hampshire State AG+31d

Pattern: first filing Jul 10 (NE), last Aug 10 (NH) — a 31-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1276-knights-of-columbus/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 3, 2026
Raw hash: 5bf0367af3308269bc543eeff29cb8a76d7852507b0ee5403c85803ae01a4c6e

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityAutoAPS, LLC

Victim entityKNIGHTS OF COLUMBUS

Incidentdiscovered May 4, 2026

Stated responseVendor reported suspicious activity immediately

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov