HackingTechnologyInformationStolen CredentialsCustomer Data InvolvedHealth (basic)Identity (basic)Government IDMediumContained

Phoenix Environmental Laboratories

bd_f76a761b9c8cde8a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 25, 2026

Filed

Jul 7, 2026

To disclose

18 weeks

Affected

29state residents only

Linked

5 records

Confidence

66%

Full breach record for Phoenix Environmental Laboratories →2 incidents on file

Phoenix Environmental Laboratories, Inc. notified Massachusetts residents of a data security incident discovered on February 25, 2026. Unauthorized access to files containing names was determined on June 18, 2026. PEL engaged cybersecurity specialists, enhanced security measures, and offered credit monitoring services. No evidence of misuse was found.

J jump to incidentP pin to compareR raw source

Massachusetts clock✗ MA AG >90d18 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 19 weeks / 132 days

Feb 25, 2026

Discovered

Jul 7, 2026

Filed

vs. sector median

+7 wks slower

This filing is one of 5 records about the same incident.View merged incident

A leak claim by dragonforce about this victim was first seen 116 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitedragonforcebd_92f56c9866ec814f2026-03-13 · +116dVerified by operator

Regulatory filings (3) · sorted by filing gap

New Hampshire State AGbd_efb31e5e03cc600b2026-07-06 · +1dVerified by operator
Vermont State AGbd_519fe45d59ef45eb2026-07-01 · +6dCandidate
Indiana State AGbd_92011c978f0b0b362026-07-01 · +6dVerified

Name: Phoenix Environmental Laboratories
norm: phoenix environmental laboratories
Domain: phoenixlabs.com

Name: Phoenix Environmental Laboratories
norm: phoenix environmental laboratories
Domain: phoenixlabs.com
Industry: Technologyllm

Discovered: Feb 25, 2026
Materiality determined: —
Notification sent: Jul 1, 2026
Affected individuals: 29state-resident count only
Data types: Health (basic)Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Engaged cybersecurity specialists to assist with the process
Offering complimentary credit monitoring and identity theft protection services
Providing proactive fraud assistance through Cyberscout
Changes made: Implemented measures to enhance security and minimize the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(126 days from discovery to filing)
Compliance flags: MA AG >90dLeak >90d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Vermont State AGJul 1 · first

Indiana State AGJul 1 · first

New Hampshire State AG+5d

Massachusetts State AG+6d · this page

Pattern: first filing Jul 1 (VT), last Jul 7 (MA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1091-phoenix-environmental-laboratories/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 7, 2026
Raw hash: 7b00950dca98366e272280df17f3062aa3f90b4b825d96e3e3554ed39e170bfa

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityPhoenix Environmental Laboratories

Victim entityPhoenix Environmental Laboratories

Incidentdiscovered Feb 25, 2026

Stated responseEngaged cybersecurity specialists to assist with the process

ComplianceMA AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov