Magnolia Management data breach: assisted living operator's email account accessed in April 2026

Date	Event
On or about April 3, 2026	Magnolia Management finds unauthorized activity in an employee email account
August 10, 2026	Review of the affected data completed
October 30, 2026	Date on the letters
November 2, 2026	Massachusetts (3,134 residents) and Vermont (34) log the notice

What happened at Magnolia Management?

The letter says the company noticed unauthorized activity in one employee's email account, secured its email and investigated. It concluded that "a limited amount of information may have been accessed" and then reviewed the affected data to learn what it held and whose it was. That review ended on August 10, 2026. In response it reset passwords and reviewed its policies. The letter does not say how the account was reached, for example by phishing, and says there is no evidence of misuse.

What information was exposed?

The letter names the person's first and last name and leaves the rest as a field completed per letter. The state records describe the notice as a whole:

Record	Residents	Data marked as involved
Massachusetts OCABR, report 2026-1917	3,134	SSN, medical records, financial account, driver's license
Vermont Attorney General	34	Health records
Letter (Rhode Island)	21	Not stated in the count line

Massachusetts does not mark credit or debit card numbers. The letter does not say whether the people it went to are residents of the communities, their families or staff. Your own letter lists the elements found about you.

What is Magnolia offering, and when must I enroll?

Experian IdentityWorks single-bureau credit monitoring for 24 months, at no cost, with identity restoration available for 24 months from the date of the letter. You enroll yourself with the activation code in the letter, by February 26, 2027. Questions go to the address in the letter, 200 North Main St, Suite 204, East Longmeadow, MA 01028, or to the contact it gives, Monday through Friday, 8 am to 8 pm Central. Credit monitoring offers in breach letters compares this offer with the others in the log.

What should a resident's family do?

The letter recommends watching account statements, credit history and explanation of benefits forms for anything unexpected. It also says the notice was not delayed by law enforcement. An explanation of benefits lists the care billed to an insurer in a person's name, so it is where care that was never received would show up.

Where can I read about similar email account breaches?

Business email compromise defines the attack, healthcare provider breach notices shows what clinics and care operators tell patients, and the health care hub lists every health care notice on record. The largest breaches affecting Massachusetts residents in 2026 ranks the state's report.