The 2026 Orthopaedic Specialists of Massachusetts data breach involved unauthorized access to the organization's network. According to the official notice, certain patient and employee information may have been copied by an unauthorized individual between January 12 and January 15, 2026.
The U.S. Department of Health and Human Services Office for Civil Rights recorded the event as a hacking/information-technology incident involving a network server and reported 20,659 affected individuals.
Verified Incident TimelineThe organization detected suspicious network activity on January 15, 2026, and began an investigation with legal counsel and independent forensic specialists. The investigation found that certain information concerning Orthopaedic Specialists of Massachusetts patients and employees, as well as patients of Steven Sand, M.D., may have been copied. The data review was completed on June 8.
What Information May Have Been Affected?The scope may vary by person. The official notice lists names, addresses, phone numbers, dates of birth, Social Security numbers, patient identification numbers, medical account numbers, medical records, health-insurance information, and other medical information.
How the Organization RespondedThe organization says it worked with outside specialists to investigate, notified applicable regulators, and mailed letters to potentially affected people for whom it had a valid address. The sample letter published by the Massachusetts Attorney General states that recipients were offered 24 months of complimentary credit-monitoring and identity-protection services.
What Should Affected People Do?Notice recipients should monitor financial-account activity, credit reports, and health-insurance explanation-of-benefits statements for an unfamiliar transaction or service. People whose Social Security number was affected may consider a free fraud alert or credit freeze based on their circumstances.