HackingPHIHealth (basic)Identity (basic)Government IDFinancial accountMediumContained

Penobscot Valley Hospital

bd_e929577a7e0fec15 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 28, 2026

Filed

Jul 20, 2026

To disclose

—

Affected

5state residents only

Linked

4 filings

Confidence

67%

Full breach record for Penobscot Valley Hospital →2 incidents on file

Penobscot Valley Hospital notified the Nebraska AG of a data security incident discovered on January 28, 2026, involving unauthorized access to patient files. The breach affected 5 Nebraska residents, exposing PHI, SSNs, and financial data. The hospital engaged forensic specialists, notified law enforcement, and provided 12 months of credit monitoring and identity protection services to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 28, 2026

Discovered

Jul 20, 2026

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Vermont State AGbd_3d98d269a1b2f4092026-07-21 · +1dCandidate
New Hampshire State AGbd_62a4ed2d04ea568e2026-07-24 · +4dVerified
Massachusetts State AGbd_1ae71e4bfba5b61f2026-07-27 · +7dVerified

Name: Penobscot Valley Hospital
norm: penobscot valley hospital

Name: Penobscot Valley Hospital
norm: penobscot valley hospital

Discovered: Jan 28, 2026
Materiality determined: —
Notification sent: Jul 20, 2026
Affected individuals: 5state-resident count only
Data types: PHIHealth (basic)Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Nebraska Attorney General
Initial access: valid_credentials

During the incident: Implemented its incident response procedures
Took steps to secure systems
Hired third-party forensic specialists to assist with an investigation
Notified law enforcement
A third-party forensic firm was engaged to assist in the investigation
Changes made: Restored its systems
Tightened access controls
Implemented additional technical safeguards to strengthen the security of their systems
Offering identity theft protection services through TransUnion
Providing you with access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Proactive fraud assistance
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Nebraska State AGJul 20 · first · this page

Vermont State AG+1d

New Hampshire State AG+4d

Massachusetts State AG+7d

Pattern: first filing Jul 20 (NE), last Jul 27 (MA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/90f6b5c3-7e3c-413b-acb3-2dff5cce04e8.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 20, 2026
Raw hash: 55bca83fb4ab8e31ba69cee1972d10780dafe343b8bd8c12f7d945676f587266

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityPenobscot Valley Hospital

Victim entityPenobscot Valley Hospital

Incidentdiscovered Jan 28, 2026

Stated responseImplemented its incident response procedures

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov