HackingHealthcareHealthcareStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)PHIMediumContained

The Center for Advanced Eye Care

bd_d23e6ecf72cd6312 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 16, 2025

Filed

Jun 12, 2026

To disclose

25 weeks

Affected

1state residents only

Linked

7 filings

Confidence

67%

Full breach record for The Center for Advanced Eye Care →

Center for Advanced Eye notified NH AG of a cybersecurity incident discovered on Dec 16, 2025, involving unauthorized access to an Amazon S3 bucket containing legacy EHR data. One NH resident was affected. Compromised data included names, DOB, SSN, medical record numbers, and health info. The Practice isolated the environment, engaged forensic investigators, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 25 weeks / 178 days

Dec 16, 2025

Discovered

Jun 12, 2026

Filed

vs. sector median

+14 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Vermont State AGbd_22d99fb77fd66de02026-02-20 · +112dVerified
HHS OCRbd_7e831a6129cad9bb2026-02-20 · +112dVerified
Massachusetts State AGbd_f3911209750895c32026-02-20 · +112dVerified
Indiana State AGbd_08b67fc72f162d1d2026-02-19 · +113dCandidate

Show 2 more filings ↓up to 113d gap

Delaware State AGbd_53ef02114fbdbda22026-02-19 · +113dVerified
Indiana State AGbd_59e817da002f0eb92026-02-19 · +113dCandidate

Name: The Center for Advanced Eye Care
norm: the center for advanced eye care

Name: The Center for Advanced Eye Care
norm: the center for advanced eye care
Industry: Healthcarellm

Discovered: Dec 16, 2025
Materiality determined: —
Notification sent: Jun 12, 2026
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Date of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1530 Data from Cloud Storage Object
Threat actor: External
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: valid_credentials

During the incident: Isolated the impacted environment
Worked with its IT professionals and outside experts to secure and remediate the server
Engaged a third-party cybersecurity firm to conduct a comprehensive forensic investigation
Moved the legacy data to a secure on-premises server
Offered all impacted individuals with complimentary credit monitoring and identity theft protection services by CyberScout, TransUnion company, for a period of twelve (12) months
Changes made: Implementing additional technical safeguards
Enhanced security measures
Updated policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(178 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 6 states

View merged incident ↗

Indiana State AGFeb 19 · first

Delaware State AGFeb 19 · first

Indiana State AGFeb 19 · first

Vermont State AG+1d

HHS OCR+1d

Massachusetts State AG+1d

New Hampshire State AG+113d · this page

Pattern: first filing Feb 19 (IN), last Jun 12 (NH) — a 113-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/center-advanced-eye-20260612.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 12, 2026
Raw hash: 11e42ec29761e1bb15629d54caf05db370aa7214c06c320ea8e61b4a331c4fe2

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityThe Center for Advanced Eye Care

Victim entityThe Center for Advanced Eye Care

Incidentdiscovered Dec 16, 2025

Stated responseIsolated the impacted environment

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov