HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICPHIMediumContained
Orthopaedic Specialists of Massachusetts
bd_ec0878647e06e7f0 · schema v1 · pii pii-v1
Full breach record for Orthopaedic Specialists of Massachusetts →Orthopaedic Specialists of Massachusetts (OSM) notified the New Hampshire Attorney General of a data event involving unauthorized access to patient and employee records. The incident occurred between January 12, 2026, and January 15, 2026, affecting 46 New Hampshire residents. Exposed data included names, addresses, SSNs, dates of birth, and medical/insurance information. OSM engaged forensic investigators, offered 12 months of credit monitoring, and mailed notification letters on June 12, 2026.
Leak gap clock⏱ Leak >90d22 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 2 about the same incident.View merged incident
A leak claim by beast about this victim predates this filing by 146 days.View originating leak claim
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_f843b5ee3aa13c27Vermont State AGfiled 2026-06-12Candidate
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/orthopaedic-specialists-massachusetts-20260612.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 12, 2026
- Raw hash
- 93b46b77bf84e2346e4c497d474d13e75c657de1f95f461ec16506d384db4e6a
Reporting entity
- Name
- Wilson, Elser, Moskowitz, Edelman & Dicker LLPnorm: wilson elser moskowitz edelman dicker
Victim entity
- Name
- Orthopaedic Specialists of Massachusettsnorm: orthopaedic specialists of massachusetts
- Domain
- orthomass.com
Incident
- Discovered
- Jan 12, 2026
- Materiality determined
- —
- Notification sent
- Jun 12, 2026
- Affected individuals
- 46
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICPHI
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1119 Automated Collection
- Threat actor
- External
- Regulator citations
- Notified New Hampshire Attorney General Consumer Protection Bureau
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 22 weeks(151 days from discovery to filing)
- Compliance flags
- Leak >90d
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.