Orthopaedic Specialists of Massachusetts 2026 Data Breach
The 2026 Orthopaedic Specialists of Massachusetts data breach involved unauthorized access to the organization's network.
Exposed Data Types
4 sensitive9- Patient IDs
- Medical records
- Health insurance information
- Medical information
- Names
- Physical addresses
- Phone numbers
- Dates of birth
- Social security numbers
About This Breach
According to the official notice, certain patient and employee information may have been copied by an unauthorized individual between January 12 and January 15, 2026.
The U.S. Department of Health and Human Services Office for Civil Rights recorded the event as a hacking/information-technology incident involving a network server and reported 20,659 affected individuals.
Verified Incident Timeline
The organization detected suspicious network activity on January 15, 2026, and began an investigation with legal counsel and independent forensic specialists. The investigation found that certain information concerning Orthopaedic Specialists of Massachusetts patients and employees, as well as patients of Steven Sand, M.D., may have been copied. The data review was completed on June 8.
What Information May Have Been Affected?
The scope may vary by person. The official notice lists names, addresses, phone numbers, dates of birth, Social Security numbers, patient identification numbers, medical account numbers, medical records, health-insurance information, and other medical information.
How the Organization Responded
The organization says it worked with outside specialists to investigate, notified applicable regulators, and mailed letters to potentially affected people for whom it had a valid address. The sample letter published by the Massachusetts Attorney General states that recipients were offered 24 months of complimentary credit-monitoring and identity-protection services.
What Should Affected People Do?
Notice recipients should monitor financial-account activity, credit reports, and health-insurance explanation-of-benefits statements for an unfamiliar transaction or service. People whose Social Security number was affected may consider a free fraud alert or credit freeze based on their circumstances.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
