Hacker Selling Boston Jail Medical Records: What Massachusetts Breach Law Requires

Someone claiming to have hacked the medical records system at Boston’s two jails is offering the records for sale on Telegram, MassLive reported Monday. The seller says they took 60,000 records over the summer. The advertised samples include psychiatric notes, HIV status, addiction treatment and MassHealth ID numbers for people held at the Suffolk County House of Correction at South Bay and the Nashua Street Jail.

The company that runs the records system has confirmed a “cybersecurity incident.” As of MassLive’s report, the breach had not been reported to the state, and the people whose records were taken had not been told. Below is what is known, what Massachusetts and federal law require of a company in this position, and what anyone who has been held at either jail can do now.

What MassLive reported

The system. The records were in an electronic health records system made by Computer Systems Integrated Inc., which is affiliated with Correctional Psychiatric Services, or CPS Healthcare, the Quincy-based company that provides medical care at the Suffolk County jails. MassLive said CPS also serves the jails in Bristol, Plymouth, Norfolk and Middlesex counties. It did not report that records from those jails were taken.
The confirmation. MassLive first confirmed the breach in September, after the seller contacted the outlet. Computer Systems Integrated said then that it was aware of and investigating a cybersecurity incident involving the records system used at the two Suffolk jails.
The sale. According to MassLive, the seller advertised the data to more than 1,000 members of a Telegram channel, said they would sell records of “any specific individual” or the whole set, and told the reporter, “I only want $250,000.” The seller said they could not get a ransom from CPS or the sheriff’s department.
The silence. MassLive said CPS did not answer five more inquiries. A spokesperson for the Suffolk County Sheriff’s Department said the company “will complete all required notifications” once its investigation is finished, and would not comment on “any unverified claims.”
The contract. MassLive obtained the sheriff’s contract with CPS through a public records request. It reported that the contract requires CPS to encrypt personal data sent electronically, to notify the sheriff’s department “immediately” of a breach, and to comply with state breach-notice law.

MassLive said it could verify many of the names in the advertised records. The number of people affected has not been confirmed by CPS, the sheriff or any agency. The 60,000 figure is the seller’s claim. No one has been charged, and the people who carried out the hack have not been publicly identified.

What Massachusetts law requires

The state’s data breach statute is G.L. c. 93H. We read it at malegislature.gov. It assigns different duties to the company that holds the data and the organization that owns it.

A vendor that stores data must tell the owner. Under § 3(a), a person that “maintains or stores, but does not own or license” personal information must notify the owner or licensor “as soon as practicable and without unreasonable delay” once it knows or has reason to know of a breach. It must also tell the owner the date and nature of the incident and the steps it is taking.
The owner must tell the state and the people affected. Under § 3(b), a person or agency that owns or licenses the data must notify the attorney general, the director of the Office of Consumer Affairs and Business Regulation, and each affected resident, again “as soon as practicable and without unreasonable delay.”
Not knowing the total is no excuse. The statute says notice “shall not be delayed on grounds that the total number of residents affected is not yet ascertained.” Updates follow as more is learned.
What the letter to you must say. The notice to a resident must explain the right to get a police report, how to request a security freeze, that a freeze is free, and what mitigation services are being offered.
Free credit monitoring if Social Security numbers were taken. Under § 3A, if a breach includes Social Security numbers, the company must offer at least 18 months of free credit monitoring, and it cannot make you waive your right to sue as a condition.
The one allowed delay. Section 4 lets notice be put off only if a law enforcement agency decides notice would impede a criminal investigation and tells the attorney general in writing. MassLive reported in September that law enforcement was involved. Whether any agency has asked for a delay has not been reported.
Who enforces it. Under § 6, the attorney general may sue under the consumer protection law, G.L. c. 93A, § 4.

There is a limit worth knowing. Chapter 93H protects “personal information,” which the statute defines as a name combined with a Social Security number, a driver’s license or state ID number, or a financial account or card number. A diagnosis or a therapy note, standing alone, is not on that list. Medical records are covered mainly by the federal law below.

What federal health privacy law requires

The HIPAA breach notification rule, 45 C.F.R. §§ 164.400 to 164.414, applies to health care providers and their business associates that handle protected health information. We read the current text on the federal eCFR.

Sixty days. A covered entity must notify each person whose unsecured health information was breached “without unreasonable delay and in no case later than 60 calendar days after discovery of a breach,” under § 164.404(b).
Discovery is not the day the company chooses. A breach counts as discovered on the first day it is known, or “by exercising reasonable diligence would have been known,” to anyone in the workforce other than the person who committed it.
Media notice for big breaches. If more than 500 residents of a state are affected, the entity must also notify “prominent media outlets serving the State,” under § 164.406, on the same 60-day clock.
Vendors report up the chain. A business associate must notify the covered entity within the same 60 days, under § 164.410.

MassLive confirmed the incident in September. If the breach was discovered then, the 60-day federal deadline would fall in November. That depends on a discovery date that no one has made public, and on whether a law enforcement delay applies under § 164.412.

If you or a family member was held at South Bay or Nashua Street

Watch for a letter. Notice may come by mail. If you have moved, the company may use substitute notice, which under c. 93H includes posting on its website and through the media.
Freeze your credit. A security freeze at Equifax, Experian and TransUnion is free and blocks new accounts in your name. You do not need to wait for a notice to do it.
Watch your MassHealth account. MassLive reported that most of the advertised records include MassHealth ID numbers. Look for services you did not receive on any MassHealth or insurer statements, and report anything wrong to MassHealth.
Get a police report if your identity is misused. The statute gives residents the right to one, and you will need it for disputes.
Be careful with anyone who contacts you about the breach. A breach of sensitive health data invites extortion and fake “breach settlement” scams. Verify any caller through a number you look up yourself.
Keep records. Save any notice and note the date it arrived. Breach lawsuits often turn on what information was taken and when people were told.

Not the first jail breach

MassLive noted that in January 2026, the Middlesex County Sheriff’s Office gave public notice of a breach of health information of people treated while incarcerated in Billerica. More than 15,000 people were affected, and the breach had occurred a year earlier. MassLive also reported that 11 people have sued Boston Health Care for the Homeless in Suffolk Superior Court over a separate breach affecting more than 185,000 people.

People in jail have little control over who holds their medical records. They cannot choose their doctor, and they often cannot easily check their mail or credit. That is part of why the notice timing in this case matters.

Frequently asked questions

Was the Suffolk County Sheriff’s Department hacked?

According to MassLive, no. The breach hit the electronic health records system run by the department’s medical contractor. The department said the contractor has indicated it “will complete all required notifications” when its investigation ends.

How many people’s records were stolen?

That has not been confirmed. The seller claims 60,000 records. Neither CPS Healthcare nor the sheriff’s department has given a number, and as of MassLive’s November 2 report the breach had not been reported to the state.

How long does a company have to notify me of a data breach in Massachusetts?

State law requires notice “as soon as practicable and without unreasonable delay” and bars waiting until the total number affected is known. For medical records covered by HIPAA, the outer limit is 60 calendar days after the breach is discovered, unless law enforcement has asked for a delay.

Do I get free credit monitoring?

Under G.L. c. 93H, § 3A, yes, for at least 18 months, if your Social Security number was taken. Whether Social Security numbers were in this data has not been confirmed.

Can I sue over a medical data breach?

People have sued in Massachusetts over other breaches, including the Boston Health Care for the Homeless breach. Chapter 93H itself is enforced by the attorney general, and the credit monitoring section says a company cannot make you give up a private right of action to get monitoring. Whether a claim exists depends on the facts.

Sources: MassLive, “A hacker is selling Mass. prisoners’ medical records,” November 2, 2026, by Hadley Barndollar; G.L. c. 93H, §§ 1, 3, 3A, 4 and 6, read at malegislature.gov; 45 C.F.R. §§ 164.404, 164.406 and 164.410, read on the eCFR. The record count, the asking price and the hacker’s statements are the seller’s claims as reported by MassLive and have not been independently confirmed. General information, not legal advice.