The incident stems from unauthorized access to the company's network, which was discovered on July 20, 2026. Forensic investigators determined that an employee inadvertently emailed sensitive documents to an unauthorized party around July 18. While the company officially reported the breach to state regulators on September 10, the full scale of the exposure remains unclear beyond the initial count of New Hampshire victims.

Potentially exposed data includes Social Security numbers, financial records, and extensive medical histories, ranging from diagnoses and prescription information to health insurance details. Edelson Lechtzin LLP is now seeking to represent affected individuals, arguing that the breach subjects customers to long-term risks of identity theft and financial fraud. The firm is offering confidential evaluations to determine if a class action lawsuit can recover damages for lost privacy and out-of-pocket costs incurred by victims.