AccidentalHealthcareGovernmentHealthcareMisdeliveryData ExfiltratedCustomer Data InvolvedPHIGovernment IDIdentity (basic)MediumContained

MassHealth

bd_ef86d1f9b3792138 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 1, 2026

Filed

Jul 16, 2026

To disclose

11 weeks

Affected

Not disclosed

Confidence

66%

Full breach record for MassHealth →2 incidents on file

MassHealth, operated by the Massachusetts Executive Office of Health and Human Services, disclosed that a document containing protected health information (PHI), names, MassHealth IDs, and Social Security numbers was inadvertently posted to mass.gov between December 22, 2025, and May 14, 2026. The document was accessible via web search but had no internal links. MassHealth removed the document upon discovery in May 2026, offered 24 months of credit monitoring via Experian, and is reviewing procedures to prevent recurrence.

J jump to incidentP pin to compareR raw source

Massachusetts clock⏱ MA AG >30d11 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 130 days

discovery → filing · 11 weeks / 76 days

Dec 22, 2025

Begins

May 1, 2026

Discovered

Jul 16, 2026

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Executive Office of Health and Human Services MEDICAID
norm: executive office of health and human services medicaid

Name: MassHealth
norm: masshealth
Industry: HealthcarellmGovernmentllm

Discovered: May 1, 2026
Breach occurred: Dec 22, 2025 – May 14, 2026
Undetected for: 130 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIGovernment IDIdentity (basic)
Data elements: Social Security number
Attack vector: Misconfiguration
MITRE ATT&CK: T1535 Unused/Unsupported Cloud Storage

During the incident: Took down the document from its website
Confirmed that the document is no longer findable through major search engines and the Internet Archive
Opened an investigation
Offering complimentary access to Experian IdentityWorks for 24 months
Changes made: Reviewing its procedures
Establish new safeguards to reduce the risk of a future incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(76 days from discovery to filing)
Compliance flags: MA AG >30d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1154-executive-office-of-health-and-human-services-medicaid/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 16, 2026
Raw hash: d1b4e8c643d4fa482bf91c69628289b548e602650f34f1e6a25db794333ef247

Reporting entityExecutive Office of Health and Human Services MEDICAID

Victim entityMassHealth

Incidentdiscovered May 1, 2026

Stated responseTook down the document from its website

ComplianceMA AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov