Millstone Medical Outsourcing, LLC, a Massachusetts-based company that provides packaging, sterilization, and logistics services for medical device manufacturers, has disclosed a data breach after discovering suspicious activity within its computer systems.
Companies that handle data on behalf of medical device manufacturers and healthcare clients are entrusted with sensitive personal information, and they have a responsibility to keep that information protected from unauthorized access.
Millstone Medical Outsourcing’s Data Breach Investigation
According to the company’s own notice, Millstone Medical Outsourcing became aware of suspicious activity impacting its systems on December 16, 2025. Following the discovery, the company initiated an investigation with the assistance of third-party cybersecurity experts to determine the scope and nature of the incident. That investigation determined that between December 15, 2025, and December 19, 2025, certain company data was subject to unauthorized access and/or acquisition.
Millstone Medical Outsourcing then engaged a third-party data review expert to conduct a comprehensive review of the affected files, a process that can take many months for a company of any size. According to the notice, that review was not completed until July 15, 2026, roughly seven months after the incident was first discovered, when it was determined that personal information had in fact been subject to unauthorized access and/or acquisition.
This kind of extended timeline between a breach’s discovery and the completion of a data review is common in the industry, since forensic investigators must carefully identify which specific files were accessed, determine whose personal information was contained in those files, and locate current contact information for every affected individual before notifications can be sent. Millstone Medical Outsourcing has stated that it is currently unaware of any personal information from the incident being publicly released, though it has not ruled out that possibility.
Data security incidents at companies that serve the medical device and healthcare supply chain can be particularly concerning, because the information these vendors handle often includes not just contact details but also records tied to medical devices, patients, or healthcare providers further down the supply chain. Even when a company reports no evidence of misuse, affected individuals are generally encouraged to remain vigilant, since exposed personal information can be used for identity theft or fraud well after the initial incident.
When Did This Breach Occur?
Millstone Medical Outsourcing states that the unauthorized access occurred between December 15, 2025, and December 19, 2025. The company became aware of the suspicious activity on December 16, 2025, but did not confirm that personal information was involved until its data review concluded on July 15, 2026. Notifications to affected individuals and to state regulators, including a filing with the Vermont Attorney General’s office reporting two affected Vermont residents, followed in the months after that determination.
What Information Was Breached?
Millstone Medical Outsourcing has not published a specific, itemized list of the data elements involved in this incident. The company has said it is working to notify impacted individuals and customers directly, and that notification letters describe what categories of information were involved in each person’s specific case.
What You Can Do
Millstone Medical Outsourcing is providing affected individuals with twenty-four months of complimentary credit monitoring and identity protection services through TransUnion. If you receive a notice from the company, consider the following steps:
- Enroll in the complimentary credit monitoring and identity protection services offered in your notification letter
- Review your credit reports and financial account statements regularly for unfamiliar activity
- Consider placing a fraud alert or credit freeze with the major credit bureaus
- Be cautious of unsolicited emails, calls, or texts referencing this incident
- Keep your notification letter and any confirmation of enrollment in monitoring services for your records
File a Data Breach Lawsuit Against Millstone Medical Outsourcing
If your personal information was exposed as a result of this breach, you may have legal options available to you.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
