HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedTargetedIdentity (basic)Government IDFinancial accountFinancial credentialsHealth (basic)PHIMediumContained

PHILADELPHIA CORPORATION FOR AGING

bd_f17142d586bacbe6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 25, 2025

Filed

Mar 13, 2026

To disclose

33 weeks

Affected

10state residents only

Linked

2 filings

Confidence

66%

Full breach record for PHILADELPHIA CORPORATION FOR AGING →4 incidents on file

Philadelphia Corporation for Aging (PCA) submitted a supplemental data event notice to the New Hampshire Attorney General regarding a cybersecurity incident. PCA became aware of unusual network activity on July 25, 2025, involving unauthorized copying of data between July 10 and July 25, 2025. The incident affected 10 New Hampshire residents, exposing names, SSNs, financial account numbers, and health/Medicaid information. PCA engaged forensic specialists, reported to law enforcement, and provided 12 months of credit monitoring. This is a follow-up to an initial notice filed November 4, 2025.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 15 days

discovery → filing · 33 weeks / 231 days

Jul 10, 2025

Begins

Jul 25, 2025

Discovered

Mar 13, 2026

Filed

vs. sector median

+14 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Vermont State AGbd_7770fe7283831e932026-03-13Candidate

Name: PHILADELPHIA CORPORATION FOR AGING
norm: philadelphia corporation for aging

Name: PHILADELPHIA CORPORATION FOR AGING
norm: philadelphia corporation for aging
Industry: Professional Servicesllm

Discovered: Jul 25, 2025
Breach occurred: Jul 10, 2025 – Jul 25, 2025
Undetected for: 15 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 4, 2025
Affected individuals: 10state-resident count only
Data types: Identity (basic)Government IDFinancial accountFinancial credentialsHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Submitted supplemental notice to New Hampshire Attorney General's Consumer Protection Bureau
Initial access: valid_credentials

During the incident: Retained legal counsel and third-party forensic specialists
Began a comprehensive review of the data set
Offered at least 12 months of complimentary credit monitoring and identity theft restoration services
Reported the event to law enforcement
Changes made: Implemented enhanced security controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(231 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Vermont State AGMar 13 · first

New Hampshire State AGMar 13 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/philadelphia-corporation-aging-20260313.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 13, 2026
Raw hash: 253be0715a2e811e720815bfe59ba88fd182a4fe7f062aac2f3aa10d4bd22040

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityPHILADELPHIA CORPORATION FOR AGING

Victim entityPHILADELPHIA CORPORATION FOR AGING

Incidentdiscovered Jul 25, 2025

Stated responseRetained legal counsel and third-party forensic specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov