HackingHealthcareHealthcareCustomer Data InvolvedData ExfiltratedFinancial accountHealth (basic)Identity (basic)Government IDPHIMediumContained

Western Orthopaedics

bd_dd272a44847c4700 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 2, 2025

Filed

May 1, 2026

To disclose

30 weeks

Affected

46state residents only

Linked

6 records

Confidence

65%

Full breach record for Western Orthopaedics →

Western Orthopaedics, P.C. disclosed a security incident occurring between September 17 and 25, 2025, where an unauthorized third party accessed patient data. The breach exposed protected health information, names, addresses, SSNs, DOBs, and financial account numbers. Western Ortho engaged cybersecurity experts, contained the network, and offered complimentary credit monitoring via Epiq. The incident was discovered on October 2, 2025, and the notification was filed with Massachusetts authorities in March 2026.

J jump to incidentP pin to compareR raw source

Massachusetts clock✗ MA AG >90d30 weeks discovery → filing

Incident timeline

undetected · 15 days

discovery → filing · 30 weeks / 211 days

Sep 17, 2025

Begins

Oct 2, 2025

Discovered

May 1, 2026

Filed

vs. sector median

+21 wks slower

This filing is one of 6 records about the same incident.View merged incident

A leak claim by pear about this victim was first seen 209 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitepearbd_1b5a6c58e8d0d6a02025-09-30 · +213dVerified

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_7cfe93f602b1b9ef2026-05-01Candidate
HHS OCRbd_9d4742af409277552026-05-01Verified
Nebraska State AGbd_f99702c4eaa434f12026-05-01Verified
Texas State AGbd_207ddfb598a318082026-05-05 · +4dVerified

Name: Western Orthopaedics
norm: western orthopaedics
Domain: western-ortho.com

Name: Western Orthopaedics
norm: western orthopaedics
Domain: western-ortho.com
Industry: Healthcarellm

Discovered: Oct 2, 2025
Breach occurred: Sep 17, 2025 – Sep 25, 2025
Undetected for: 15 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 3, 2026
Affected individuals: 46state-resident count only
Data types: Financial accountHealth (basic)Identity (basic)Government IDPHI
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Took immediate steps to investigate, contain, and remediate the incident with the assistance of our contracted cybersecurity team and external cybersecurity experts
Conducted an analysis to determine whether personal information, including protected health information, was present in the affected data
Arranged for you to enroll in complimentary credit monitoring and identity protection services for <<CM Duration>> months, at no cost to you, through Epiq
Changes made: Arranged for you to enroll in complimentary credit monitoring and identity protection services for <<CM Duration>> months, at no cost to you, through Epiq
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(211 days from discovery to filing)
Compliance flags: MA AG >90dLeak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGMay 1 · first

HHS OCRMay 1 · first

Nebraska State AGMay 1 · first

Massachusetts State AGMay 1 · first · this page

Texas State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-684-western-orthopaedics-pc/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 1, 2026
Raw hash: 277e5ac04ae8a62932fabef40b0f8da5f0445ff95db504997aa5bda1ddb886ed

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityWestern Orthopaedics

Victim entityWestern Orthopaedics

Incidentdiscovered Oct 2, 2025

Stated responseTook immediate steps to investigate, contain, and remediate the incident with the assistance of our contracted cybersecurity team and external cybersecurity experts

ComplianceMA AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov