LeMaitre Vascular data breach: a January network disruption, letters eight months later

Date	Event
On or around January 10, 2026	LeMaitre discovers a network disruption and starts an investigation with outside experts
February 26, 2026	The 2025 Form 10-K describes a January 2026 cybersecurity incident; the data review is still ongoing
On or about September 14, 2026	The review finds personal information of the people who get letters
September 18, 2026	Letters; report to New Hampshire (about 92 residents) and Massachusetts (955)
December 18, 2026	Deadline to enroll in the identity protection offered

What happened at LeMaitre Vascular?

The letter calls it a network disruption. LeMaitre says it brought in independent cybersecurity experts at once, and that the investigation showed certain files may have been accessed and acquired without authorization. The letters do not name the attacker, do not say whether ransomware was used, and do not say how the intruder got in.

The company's annual report, filed six weeks after the discovery, gives more of the operational side. It says LeMaitre activated its incident response plan, engaged outside advisers for containment and the investigation, and securely restored its critical systems. For a while after the incident it ran some work under alternative processes to keep the business going. The 10-K adds that there was minimal to no disruption to manufacturing, product release and service to customers.

Did LeMaitre file an 8-K about the cyberattack?

No. LeMaitre is listed on Nasdaq and files with the SEC, but its 2026 filing index shows no 8-K under Item 1.05 or about the incident. Its 2026 8-Ks cover quarterly results, board changes and a shareholder vote. The incident appears in the 10-K's risk factors instead, which said that, as of the filing date, the company believed it had not had a material impact on its financial condition or results.

That is the usual path for an incident a company judges not material: a mention in the next periodic report, and the state letters once the data review ends. The 10-K said that review was still running and that LeMaitre would evaluate any notification obligations when it was done. For how other companies split the same decision, see Item 8.01 versus Item 1.05.

Why did the letters take eight months?

The notice to New Hampshire puts it down to the file review. It says LeMaitre found out on or about September 14, 2026, after a complex and lengthy data review, that personal information of New Hampshire residents was in the affected data. That is 247 days after the January 10 discovery, and the letters went out four days later. For how this compares with other notices, see the notice letter delay guide.

What information was exposed?

Names with Social Security numbers, USCIS Alien Registration numbers and financial account numbers. The Massachusetts record marks Social Security numbers, medical records and driver's licenses, but not financial accounts. State forms often mark the categories differently from the letter, so the table keeps both as filed.

Record	People	Data it marks
Massachusetts OCABR, report 2026-1579 (September 18, 2026)	955	SSNs, medical records, driver's licenses
New Hampshire DOJ notice, September 18, 2026	about 92	Name, SSN, USCIS Alien Registration number, financial account number

The Massachusetts report files LeMaitre under "Retail" as the organization type. LeMaitre says it has no evidence that anyone has misused, or tried to misuse, the information.

What is LeMaitre offering?

Twelve months of identity protection through Cyberscout, a TransUnion company: credit monitoring, dark web monitoring, a $1 million identity fraud loss reimbursement policy and identity theft recovery services. The enrollment deadline is December 18, 2026, and the call center is at 1-888-941-8669 on weekdays. A USCIS Alien Registration number is not a credit identifier, so credit monitoring will not show its misuse. For how these offers compare, see the credit monitoring guide.

What the documents leave open

• The total number of people notified across all states.
• Whether the people notified are employees, patients or others; the letters do not say.
• How the intruder got into the network, and whether a ransom was demanded.