HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PHIMediumContained

Western Orthopaedics

bd_f99702c4eaa434f1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 2, 2025

Filed

May 1, 2026

To disclose

—

Affected

Not disclosed

Linked

6 records

Confidence

66%

Full breach record for Western Orthopaedics →

Western Orthopaedics PC notified Nebraska AG of a security incident occurring between Sept 17-25, 2025, discovered Oct 2, 2025. Unauthorized access resulted in exposure of PHI, SSNs, DOBs, and financial account numbers. Remediation included forensic investigation and complimentary credit monitoring via Epiq. No indication of identity theft to date.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 15 days

Sep 17, 2025

Begins

Oct 2, 2025

Discovered

May 1, 2026

Filed

This filing is one of 6 records about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitepearbd_1b5a6c58e8d0d6a02025-09-30 · +213dVerified

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_7cfe93f602b1b9ef2026-05-01Candidate
HHS OCRbd_9d4742af409277552026-05-01Verified
Massachusetts State AGbd_dd272a44847c47002026-05-01Verified
Texas State AGbd_207ddfb598a318082026-05-05 · +4dVerified

Name: Western Orthopaedics
norm: western orthopaedics
Domain: western-ortho.com

Name: Western Orthopaedics
norm: western orthopaedics
Domain: western-ortho.com
Industry: Healthcarellm

Discovered: Oct 2, 2025
Breach occurred: Sep 17, 2025 – Sep 25, 2025
Undetected for: 15 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Took immediate steps to investigate, contain, and remediate the incident with the assistance of our contracted cybersecurity team and external cybersecurity experts
Conducted an analysis to determine whether personal information, including protected health information, was present in the affected data
Arranged for you to enroll in complimentary credit monitoring and identity protection services for <<CM Duration>> months, at no cost to you, through Epiq
Changes made: Arranged for you to enroll in complimentary credit monitoring and identity protection services for <<CM Duration>> months, at no cost to you, through Epiq
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGMay 1 · first

HHS OCRMay 1 · first

Massachusetts State AGMay 1 · first

Nebraska State AGMay 1 · first · this page

Texas State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/d26e80b3-2886-4f9d-b761-4692f01dd400.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 1, 2026
Raw hash: 307a9ee9f673a1c26b9d621d9fdf6f6aaca44d419b4c16f9f4e03ecd7ed23056

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityWestern Orthopaedics

Victim entityWestern Orthopaedics

Incidentdiscovered Oct 2, 2025

Stated responseTook immediate steps to investigate, contain, and remediate the incident with the assistance of our contracted cybersecurity team and external cybersecurity experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov