HackingHealthcareHealthcareStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Central Texas MHMR Center

bd_e51e7467e843458c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 17, 2025

Filed

Jul 22, 2026

To disclose

—

Affected

3state residents only

Linked

5 filings

Confidence

66%

Full breach record for Central Texas MHMR Center →2 incidents on file

Central Texas MHMR dba Center for Life Resources (CFLR) notified Nebraska AG of a breach affecting 3 Nebraska residents. Unauthorized access occurred Nov 14-15, 2025; discovered Nov 17, 2025. Names and SSNs were copied. Written notice sent July 22, 2026. Response included law enforcement notification, cybersecurity investigation, credit monitoring via TransUnion, and HHS notification.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

Nov 14, 2025

Begins

Nov 17, 2025

Discovered

Jul 22, 2026

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_169e0607bd9dd9bc2026-07-22Candidate
Vermont State AGbd_4c7ceaa1fb482f292026-07-22Verified
New Hampshire State AGbd_829891e97ffbf36a2026-07-22Verified
Texas State AGbd_4b94a33a642beb292026-07-23 · +1dVerified

Name: Central Texas MHMR Center
norm: central texas mhmr center

Name: Central Texas MHMR Center
norm: central texas mhmr center
Also named: Central Texas MHMRdba oflegal entity
Center for Life Resourcesdba oftrade name
Industry: Healthcarellm

Discovered: Nov 17, 2025
Breach occurred: Nov 14, 2025 – Nov 15, 2025
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 22, 2026
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified the U.S. Department of Health and Human Services
Initial access: valid_credentials

During the incident: Secured the network
Launched an investigation with assistance from cybersecurity specialists
Notified federal law enforcement
Implemented additional safeguards
Provided access to credit monitoring services for twelve (12) months through TransUnion
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Provided written notice to relevant state regulators
Notified the three major credit reporting agencies, Equifax, Experian, and TransUnion
Notified the U.S. Department of Health and Human Services
Changes made: Working to review existing policies and procedures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGJul 22 · first

Vermont State AGJul 22 · first

New Hampshire State AGJul 22 · first

Nebraska State AGJul 22 · first · this page

Texas State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/009f90a2-3984-413e-ae28-9c339c3cbf2e.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 22, 2026
Raw hash: 4bc6391c0c8e04f002f02e5889bf3d013e63384d2c6a9f6af2c5422283638136

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityCentral Texas MHMR Center

Victim entityCentral Texas MHMR Center

Incidentdiscovered Nov 17, 2025

Stated responseSecured the network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov