Social EngineeringPhishingCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICMediumContained
Gastro Health Holdco, LLC
bd_d2f4d6ae22071958 · schema v1 · pii pii-v1
Full breach record for Gastro Health Holdco, LLC →Gastro Health notified the New Hampshire Attorney General of a phishing incident affecting approximately 35 NH residents. The breach occurred on February 25, 2026, when employee credentials were compromised via a malicious email. Gastro Health contained the incident by disabling accounts and resetting passwords. Affected data included names, SSNs, DOBs, and protected health information. Notifications were sent on May 22, 2026, offering 24 months of credit monitoring.
This filing is one of 6 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (5) · sorted by filing gap
- bd_47955d57ccbe42f7Indiana State AGfiled 2026-05-22Verified
- bd_b3e6b30ae05db95fHHS OCRfiled 2026-05-22Verified
- bd_c5c7efc4ddd11f45HHS OCRfiled 2026-05-22Verified
- bd_fa70a8cc2319eb4eWashington State AGfiled 2026-05-22Verified
Show 1 more filing ↓Show fewer ↑up to 21d gap
- bd_f89b870182b31cd2Massachusetts State AGfiled 2026-05-01(21d gap)Candidate
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/gastro-health-20260522.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 22, 2026
- Raw hash
- f14523d9b5731816990a8b4b45e067441993b3ed7b81590d6ecb4d60e11b8f4d
Reporting entity
- Name
- Gastro Health Holdco, LLCnorm: gastro health holdco
- Domain
- gastrohealth.com
Victim entity
- Name
- Gastro Health Holdco, LLCnorm: gastro health holdco
- Domain
- gastrohealth.com
Incident
- Discovered
- Feb 25, 2026
- Materiality determined
- —
- Notification sent
- May 22, 2026
- Affected individuals
- 35
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASIC
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing Link
- Threat actor
- External
- Regulator citations
- Notified New Hampshire Attorney General
- Initial access
- phishing_link
Compliance
- Time to disclose
- 12 weeks(86 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.