2025–2026 Cunningham Prosthetic Care (ME) — employee mailbox compromise exposing PHI notifications
Data compromised
Names, health insurance info, diagnoses, treatments, medical record numbers (coverage summary)
Technical writeup
HIPAA Journal said Cunningham Prosthetic Care uncovered suspicious activity in an employee email account confirmed compromised on October 22, 2025, needing months to conclude PHI—including insurance, diagnoses, MRNs—was impacted, beginning consumer mail notices May 1, 2026, with OCR-scale counts still pending disclosure.
Root cause
Business email compromise / unauthorized mailbox access around October 22, 2025