Middlesex Sheriff's Office data breach: a January 2025 intrusion, 15,322 Massachusetts residents

What happened at the Middlesex Sheriff's Office?

The letter, dated October 31, 2025, gives few details of the intrusion. It says the office worked with state and federal law enforcement and two private cybersecurity firms to work out the extent of the event. The agencies it names are the FBI, the Massachusetts State Police, the Commonwealth Fusion Center and the state's Executive Office of Technology Services and Security. The office says it knows of no misuse of anyone's information.

Date	What the letter and the regulators' records say
January 2025	Breach of security at the office
October 31, 2025	Letter date
November 19, 2025	Review finds health information was reached (office's public notice)
January 20, 2026	Report to HHS (19,080)
January 30, 2026	Logged in Massachusetts (15,322 residents)

The letter came about nine months after the breach, and the state and federal reports about three months after that.

Why does a sheriff's office report to HHS?

Because it gave people medical care. The office's public HIPAA notice says the investigation found unauthorized access to the protected health information of individuals the office may have previously provided medical care to. The HHS list carries the office as a healthcare provider.

What information was involved in the Middlesex Sheriff's Office breach?

The health information varied by person and may have included name, address, date of birth, diagnoses and other general health information, the office says. Its review reached that finding on November 19, 2025, ten months after the January 2025 breach. The office says it knows of no misuse and has secured the affected systems.

What should people do, and who can they contact?

The office urges people whose information may have been reached to watch their credit reports, consider a fraud alert, and check bank statements and insurance records for signs of fraud. It posts steps for a free security freeze on its website. Questions go to cyberinquiry@sdm.state.ma.us. Neither the letter filed with the state nor the public notice mentions a credit monitoring offer.

Where does this rank in Massachusetts?

Among 2026 notices to Massachusetts residents, the office's 15,322 count ranks 23rd. The ranking of the largest data breaches affecting Massachusetts residents in 2026 sets it beside the others, and the guide to government breach notices compares what public bodies tell residents.

What the documents leave open

• How the intruder got in and what kind of attack it was.
• How many of the 19,080 were people the office gave medical care to, and over which years.
• Why ten months passed between the breach and the finding about health information.

With 19,080 people, Middlesex Sheriff's Office's report is the 130th largest of the 415 open 2026 reports in the ranking of 2026 healthcare breaches reported to HHS.