Contoocook, New Hampshire, September 11 — Four US health care organisations disclosed data breaches in a single week, according to reporting by the HIPAA Journal, with the notifications landing at the federal Office for Civil Rights and, in at least one case, the data apparently offered for sale rather than simply held. The largest of the four by headcount is NFI North, Inc., a Contoocook, New Hampshire-based nonprofit human services organisation providing mental health, behavioral and educational support services across New Hampshire and Maine.
It notified the HHS Office for Civil Rights of a breach affecting the protected health information of 49,540 individuals. Under the hood, the timeline is the detail that matters: suspicious activity was identified within its network on or around September 6, 2025, but the investigation and data review did not conclude until July 6, 2026.
That is ten months between spotting the intrusion and knowing what was taken.
What the compromised data actually contained
The confirmed categories were broad. Names, addresses, birth dates, Social Security numbers, driver’s license numbers, financial account information, medical information and health insurance information. NFI North engaged cybersecurity professionals and implemented additional technical safeguards, and issued a substitute breach notice — the mechanism organisations use when they cannot reach affected individuals directly by post.
Nephrology Associates, M.D., P.A., a network of clinics in Kansas and Missouri treating chronic kidney disease and other kidney disorders, announced an incident affecting 24,088 individuals. Suspicious network activity was identified on or around April 9, 2026, and with third-party cybersecurity experts the practice determined its network had been accessed by an unauthorised third party between January 17, 2026, and April 9, 2026.
On July 1, 2026, it confirmed the exposed data included names, birth dates, Social Security numbers, driver’s license numbers and state identification numbers, other government identifiers, diagnosis and treatment information, and health insurance information. Notification letters began mailing on or around July 30, 2026. At that point Nephrology Associates said it was unaware of any actual or attempted misuse of the data, and offered complimentary credit monitoring to individuals whose Social Security numbers were involved.
The breach notice does not name an attacker. The incident nonetheless appears to have been the work of the cybercriminal group known as The Gentlemen — no data appears to have been leaked, but the group offered it for sale.
That distinction, between exfiltration and publication, is the one that decides whether a breach becomes a public archive.
Email accounts, and a quieter disclosure
PAMCAH-UA Local 675 Health and Welfare Fund, a multiemployer trust fund in Honolulu, Hawaii, providing medical, dental, vision and welfare benefits to union plumbers and fitters and their families, identified unauthorised access to employee email accounts. The forensic investigation determined certain accounts were accessed by an unauthorised third party between September 23, 2025, and October 9, 2025. During that window, emails and files may have been viewed or acquired.
The accounts were found to contain personal and protected health information of 8,319 individuals, including names, dates of birth, medical information, health insurance information, driver’s license numbers and Social Security numbers. Notification letters have been mailed.
Indico Data Solutions, Inc., a Massachusetts-based AI-powered software company whose products include an intake and orchestration platform, announced a data security incident involving the protected health information of 4,840 individuals. It is unclear from the data breach notice when that incident occurred — a gap that is itself worth watching, given that the vendor sits upstream of the health organisations whose data it handles. As ever, the pattern across all four is dwell time.
Intrusions detected in September 2025 and April 2026 took months of forensic review before the affected populations could be told what had gone. The next thing to watch is whether OCR’s public breach portal reflects these filings with the same figures, and whether any of the four revise their counts upward as review continues.
