Social EngineeringHealthcareHealthcarePhishingCustomer Data InvolvedFinancial accountHealth (basic)Identity (basic)Government IDMediumContained

Gastro Health Holdco, LLC

bd_f89b870182b31cd2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 25, 2026

Filed

May 22, 2026

To disclose

12 weeks

Affected

291state residents only

Linked

6 filings

Confidence

67%

Full breach record for Gastro Health Holdco, LLC →

Gastro Health disclosed a phishing incident on February 25, 2026, resulting in unauthorized access to patient files. Affected data included names, SSNs, DOBs, state IDs, medical record numbers, and financial account numbers. The incident is contained, with no indication of fraud. Gastro Health provided 24 months of credit monitoring via Epiq Privacy Solutions.

J jump to incidentP pin to compareR raw source

Massachusetts clock⏱ MA AG >30d12 weeks discovery → filing

Incident timeline

discovery → filing · 12 weeks / 86 days

Feb 25, 2026

Discovered

May 22, 2026

Filed

vs. sector median

on median

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_47955d57ccbe42f72026-05-22Verified
HHS OCRbd_b3e6b30ae05db95f2026-05-22Verified
HHS OCRbd_c5c7efc4ddd11f452026-05-22Verified
New Hampshire State AGbd_d2f4d6ae220719582026-05-22Verified

Show 1 more filing ↓

Washington State AGbd_fa70a8cc2319eb4e2026-05-22Verified

Name: Gastro Health Holdco, LLC
norm: gastro health holdco

Name: Gastro Health Holdco, LLC
norm: gastro health holdco
Industry: Healthcarellm

Discovered: Feb 25, 2026
Materiality determined: —
Notification sent: —
Affected individuals: 291state-resident count only
Data types: Financial accountHealth (basic)Identity (basic)Government ID
Data elements: Social Security numberDate of birthMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External
Initial access: phishing_link

During the incident: Took immediate action to contain the incident
Investigate its scope and impact
Conducted a detailed review of the affected files
Providing you with access to 24 months of Epiq Privacy Solutions ID at no cost
Changes made: Continually look for ways to further enhance our information security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(86 days from discovery to filing)
Compliance flags: MA AG >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Indiana State AGMay 22 · first

HHS OCRMay 22 · first

New Hampshire State AGMay 22 · first

Washington State AGMay 22 · first

Massachusetts State AGMay 22 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-835-gastro-health/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 22, 2026
Raw hash: d0ac00b0b22764d2a4ca34577c778af0f8ac8f0fda76868420320ea63b02dd1b

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityGastro Health Holdco, LLC

Victim entityGastro Health Holdco, LLC

Incidentdiscovered Feb 25, 2026

Stated responseTook immediate action to contain the incident

ComplianceMA AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov