Cardiovascular Institute of New England (“CINE”) is issuing this notice about a data security incident that may have resulted in unauthorized access to certain personal and protected health information of its employees and patients. Please know that CINE moved swiftly to investigate and remediate the incident. Information about the incident, CINE’s response, and the steps consumers may take to help protect their information are detailed below.

Importantly, CINE does not have any reason to believe that there has been any identity theft, fraud or misuse of information in connection with this incident.

What Happened? On or around February 12, 2026, CINE observed unusual activity in its email environment (the “Incident”). In response, CINE began an investigation with the assistance of third-party cybersecurity specialists to determine the nature and scope of the activity. While there is no indication that personal information was targeted or misused, out of an abundance of caution, CINE is notifying certain individuals whose personal information was in the impacted email account and may have been subject to unauthorized access.

CINE prioritized the containment and remediation of the Incident, an effort which has since completed. In addition to conducting a thorough forensic investigation of the Incident, CINE undertook a comprehensive review of the impacted data to determine what information was impacted. The review process, which was completed on or around July 14, 2026, determined that personal information may have been subject to unauthorized access. Based on CINE’s investigation and remediation efforts, there is no evidence that the impacted information has been misused as a result of this incident.

What Information Was Involved? The following types of personal information may have been subject to unauthorized access: name, phone number, date of birth, financial account number, medical information, medical diagnosis and/or treatment information, treatment location, clinical information, prescription information, and medical insurance provider information.

CINE’s Response. CINE is committed to and takes very seriously its responsibility to protect all data entrusted to it. Upon becoming aware of the unauthorized activity, CINE promptly took steps to investigate and ensure the matter was fully remediated. As part of its ongoing commitment to data privacy and security, CINE is reviewing its existing policies and security measures currently in place to protect against similar incidents moving forward.

CINE mailed notification letters to potentially affected individuals beginning July 28, 2026. Further, to help protect individuals’ information, CINE provided potentially affected individuals with access to complimentary credit monitoring and identity restoration services through Epiq.

What Potentially Affected Individuals Can Do As a best practice, CINE encourages individuals to continue to remain vigilant against incidents of identity theft and fraud by reviewing financial account statements and credit reports for any anomalies. CINE also encourages individuals to enroll to receive the complimentary services being offered. If you are one of the potentially affected individuals, a call center agent can help you enroll in the complimentary credit monitoring and identity restoration services CINE is offering. Please note the deadline to enroll in the complimentary services is October 31, 2026.

For More Information. We understand that you may have questions or concerns that are not addressed in this letter. Please call the dedicated assistance line that we have established regarding this incident by dialing 888-289-7132, Monday-Friday 9:00 AM to 9:00 PM ET.

CINE sincerely regrets the occurrence of this Incident, and is committed to the security of consumer data.

Media gallery

About The Author
Business Wire