The intrusion at the Fall River, Massachusetts-based medical device provider occurred between December 15 and December 19, 2025. Although the company detected the breach on December 16, a comprehensive internal review to verify the scope of the compromised data was not finalized until July 15, 2026. Millstone Medical Outsourcing officially reported the incident to the Vermont Attorney General’s Office in September.

While the exact number of victims remains undisclosed, the potential exposure includes Social Security numbers, government identification, financial account details, and private health records. Edelson Lechtzin LLP is offering free case evaluations to those who received breach notifications, citing concerns over identity theft and financial fraud. The firm aims to recover compensation for out-of-pocket losses and privacy damages while pressuring the company to improve its data security protocols. Affected individuals are advised to enroll in the credit monitoring services provided by Millstone and to place security freezes on their credit reports with major bureaus.