It took NFI North ten months to learn what a September 2025 intrusion had taken. The nonprofit, based in Contoocook, New Hampshire, noticed suspicious activity on its network on or around September 6, 2025. Its investigation and data review only ended on July 6, 2026. By then the picture was grim: the breach touched the protected health information of 49,540 individuals, according to a notice NFI North filed with the HHS Office for Civil Rights.
The HIPAA Journal, which reported the filing on September 8, 2026, put it alongside three other health-sector disclosures that surfaced at the same time.
NFI North, New Hampshire and Maine
NFI North provides mental health, behavioral and educational support services in both states. The data confirmed as compromised was broad: names, addresses, birth dates, Social Security numbers, driver’s license numbers, financial account information, medical information and health insurance information. The organization brought in cybersecurity professionals, added technical safeguards, and published a substitute breach notice.
Nephrology Associates, Kansas and Missouri
This network of clinics treats chronic kidney disease and other kidney disorders. It reported an incident affecting 24,088 people. Staff spotted suspicious network activity on or around April 9, 2026. With outside experts, the practice concluded that an unauthorized party had been inside its network between January 17, 2026, and April 9, 2026.
On July 1, 2026, it confirmed what had been exposed: names, birth dates, Social Security numbers, driver’s license or state ID numbers, other government identifiers, diagnosis and treatment information, and health insurance information. Letters started going out around July 30, 2026. The practice said it knew of no actual or attempted misuse, and it offered free credit monitoring to anyone whose Social Security number was involved.
The notice names no attacker. The HIPAA Journal wrote that the attack appears to be the work of a group called The Gentlemen, which has offered the data for sale. No data appears to have been leaked.
A union fund in Honolulu
The PAMCAH-UA Local 675 Health and Welfare Fund pays medical, dental, vision and welfare benefits to union plumbers and fitters. It found that an unauthorized party had reached some employee email accounts between September 23, 2025, and October 9, 2025. Emails and files in those accounts may have been viewed or taken. The accounts held information on 8,319 individuals, including names, dates of birth, medical and health insurance information, driver’s license numbers and Social Security numbers. The fund has mailed notification letters.
Indico Data Solutions, Massachusetts
Indico is an AI-powered software company whose products include an intake and orchestration platform. It announced an incident involving the protected health information of 4,840 individuals. Its notice does not say when the breach was detected or how long intruders had access. It says only that the company confirmed a cybersecurity incident on May 7, 2026. Names, addresses and Social Security numbers may have been compromised.
Indico rotated access credentials, tightened access controls and added monitoring tools. Affected corporate customers were told, and individuals received letters along with free credit monitoring and identity restoration services.
