The intrusion spanned December 15 to December 16, 2025, compromising the records of 290,357 Massachusetts residents and 86 Vermont residents. Affected entities include Hawthorn Medical Associates, Saint Anne’s Hospital, and Morton Hospital, all operating under the Lifespan banner. Despite the incident occurring last winter, the health group did not issue notifications to the public or state attorneys general until mid-July 2026.

Legal experts are scrutinizing the seven-month delay between the breach and the disclosure, questioning whether the timeline violates state and federal privacy statutes. The stolen information includes Social Security numbers, medical records, payroll data, and government-issued identification numbers. Patients impacted by the incident may be entitled to damages or court-mandated improvements to the firm’s cybersecurity protocols as investigators evaluate the extent of the negligence.