HackingHealthcareHealthcareStolen CredentialsData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)Financial accountHealth (basic)PHIMediumContained

Kentucky Mountain Health Alliance, Inc.

bd_ee88b9760195797d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 16, 2025

Filed

Jun 12, 2026

To disclose

—

Affected

2state residents only

Linked

5 filings

Confidence

66%

Full breach record for Kentucky Mountain Health Alliance, Inc. →

Kentucky Mountain Health Alliance, Inc. (KMHA) reported to the Nebraska Attorney General that on or around September 16, 2025, unauthorized access occurred to its network. The incident affected two Nebraska residents, exposing personal information including SSNs, driver's licenses, passport numbers, financial account data, and protected health information. KMHA engaged a cybersecurity firm, reported to law enforcement, and provided two affected individuals with one year of complimentary identity monitoring services. Notices were sent on June 12, 2026.

J jump to incidentP pin to compareR raw source

Incident timeline

Sep 16, 2025

Begins

Sep 16, 2025

Discovered

Jun 12, 2026

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_a107d4aed7ab0f652026-06-12Candidate
New Hampshire State AGbd_7659d88af43fd86f2026-06-19 · +7dVerified
Massachusetts State AGbd_83a570f28d6f876d2026-06-19 · +7dVerified
HHS OCRbd_f6c79ff4e60a31f72026-06-19 · +7dVerified

Name: Freeman, Mathis & Gary, LLP
norm: freeman mathis gary

Name: Kentucky Mountain Health Alliance, Inc.
norm: kentucky mountain health alliance
Domain: kymha.com
Industry: Healthcarellm

Discovered: Sep 16, 2025
Breach occurred: Sep 16, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 12, 2026
Affected individuals: 2state-resident count only
Data types: Government IDIdentity (basic)Financial accountHealth (basic)PHI
Data elements: Social Security numberMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Nebraska Office of the Attorney General
Initial access: valid_credentials

During the incident: Implemented incident response protocols and took steps to mitigate the activity, including taking certain systems offline
Launched an investigation
Engaged a cybersecurity firm to assist
Reported the incident to law enforcement
Changes made: Continues to work with its IT professionals to further enhance the security of its systems
Review its network security, including updating policies and procedures as appropriate
Providing notified individuals access to complimentary identity monitoring services
Provided individuals with guidance on how to protect against identity theft and fraud
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGJun 12 · first

Nebraska State AGJun 12 · first · this page

New Hampshire State AG+7d

Massachusetts State AG+7d

HHS OCR+7d

Pattern: first filing Jun 12 (IN), last Jun 19 (KY) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/e9a8055d-bcd9-473c-9f9d-b40392c6f0cd.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 12, 2026
Raw hash: c35d38ef87aefe63011fe7f53f0382d241cdd161252c215b245952ac30568c37

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityFreeman, Mathis & Gary, LLP

Victim entityKentucky Mountain Health Alliance, Inc.

Incidentdiscovered Sep 16, 2025

Stated responseImplemented incident response protocols and took steps to mitigate the activity, including taking certain systems offline

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov