Orthopaedic Specialists of Massachusetts data breach: patient data copied in January, letters June 12, 2026

Date	Event	Record
January 12 to 15, 2026	Unauthorized activity; data may have been copied	Notice to New Hampshire
January 15, 2026	OSM becomes aware of suspicious activity in its network	Notice to New Hampshire
June 8, 2026	OSM finishes its review of the data set	Notice to New Hampshire
June 12, 2026	Letters mailed; Massachusetts report 2026-973 (20,147); Vermont logs 7	Massachusetts, Vermont, New Hampshire

What happened at Orthopaedic Specialists of Massachusetts?

The fullest account is the notice the practice's counsel sent to New Hampshire's attorney general on June 12, 2026. It says OSM became aware of suspicious activity in its network on January 15, 2026. The practice began an investigation and retained legal counsel and third-party forensic specialists. That investigation found that information about certain patients and employees of OSM, and about patients of a second physician named in the filing, may have been copied by an unauthorized individual.

The same notice opens with a slightly different date, describing the event as first discovered by OSM on or about January 12, 2026. Its own section on the nature of the event gives January 15 as the day OSM became aware, and January 12 as the first day of the activity. This entry uses January 15 as the discovery date and keeps both dates in the table.

The filing does not say how the unauthorized individual got into the network, whether ransomware was involved, or whether anyone has claimed the data.

What information was exposed in the OSM breach?

The New Hampshire notice lists eight types of information: name, address, phone number, date of birth, Social Security number, patient identification number, health insurance information and medical information. Not every person had every type involved. The practice says it is unaware of any actual or attempted misuse of the information. The state records agree on the two most sensitive categories:

State record	Residents	Data it marks
Massachusetts OCABR, report 2026-973	20,147	Social Security numbers, medical records
New Hampshire Attorney General	46	As listed in the notice
Vermont Attorney General	7	Social Security numbers, health records

Vermont logged its notice on the same day the letters were mailed. New Hampshire's count is 46 residents. No public record found for this entry gives a national total, so the 20,200 people across these three states are a floor.

Why did the letters take five months?

The practice says it ran a comprehensive review of the data set to work out what personal information was involved and whom it concerned, and that the review finished on June 8, 2026. Letters followed four days later. From the January 15 discovery to the June 12 mailing is 148 days. The guide to how long companies take to notify compares that with the deadlines in state law and HIPAA, and with the times other healthcare organizations took.

What is OSM offering, and what should patients do?

At least 12 months of credit monitoring and identity theft restoration through Cyberscout, a TransUnion company, at no cost. The letter filed in Massachusetts explains the state's rules: a resident can get any police report filed about the incident, and a security freeze has to be requested from each of the three credit bureaus. It adds that no fee may be charged to place, lift or remove a freeze.

The credit monitoring guide compares this offer with other letters, and the healthcare provider guide explains what a HIPAA breach letter must contain.

Why does the Massachusetts letter not say what happened?

Because Massachusetts law forbids it. Chapter 93H says the notice to a resident shall not include the nature of the breach or the number of Massachusetts residents affected. So letters sent to Massachusetts residents carry the rights and steps text, and little else. The account of what happened comes from the notice to New Hampshire, which has no such limit. The Massachusetts copy, dated June 12, 2026, matches the New Hampshire filing's mailing date.

What the documents leave open

• How the unauthorized individual got into OSM's network, and whether ransomware or a data-theft claim was involved.
• The total number of people notified across all states.
• Whether OSM reported the incident to the federal health breach list, and with what count; the HHS portal could not be read when this entry was written.