The Center for Discovery has sent a data breach notice to people whose information may have been involved in a cyber incident at Accumedic Computer Systems, its third-party billing services vendor. The notice was posted by the Massachusetts Attorney General’s office.
The incident described in the letter took place at the vendor, not on the Center’s own network. Organizations that share personal information with outside vendors are still expected to make sure that information is protected.
The Center for Discovery’s Data Breach Investigation
The notice says The Center for Discovery is writing about a recent incident experienced by its third-party billing services vendor, Accumedic Computer Systems, that may have involved some of the recipient’s personal information. The Center states that it is unaware of any attempted or actual misuse of information involved in the incident, and it explains the steps people can take to protect themselves.
According to the notice, Accumedic told the Center on August 25, 2026 that a cyber incident had affected its systems and caused a disruption in services. The vendor reported that it immediately isolated the affected servers, notified law enforcement, and began an investigation with the help of third-party forensic experts. The investigation determined that an unauthorized third party first gained access to the vendor’s systems on or around April 8, 2026, and potentially obtained customer information between June 4 and 8, 2026.
Those dates are worth reading closely. They suggest that the unauthorized party had a foothold in the vendor’s systems for roughly two months before the window in which customer information may have been taken, and that the vendor did not alert the Center until after a disruption in services. The notice then says the vendor worked with a dedicated review team, including internal and external experts, to analyze the affected files and identify which personal information they contained, a process the notice describes as detailed because of the nature and complexity of the data.
The Massachusetts filing list shows that three Massachusetts residents were affected. That figure applies to Massachusetts only. The notice does not give a total number of people affected, and it does not say which other organizations that use the same vendor may have been involved, so this page does not offer a nationwide count.
The notice says that after discovering the incident, the vendor restored its systems and operations, notified law enforcement, and has been cooperating with the ongoing law enforcement investigation. It also says the vendor has taken additional steps to harden the security of its systems and networks, and that the notification was not delayed as a result of law enforcement. The Center says it is notifying people in case they decide to take further steps to protect their information. It offers credit monitoring and identity restoration services through Epiq at no charge, and the enrollment instructions describe one bureau credit monitoring with alerts for key changes such as credit inquiries, new accounts, and public records, along with basic dark web monitoring.
The copy posted with the state is a template. The recipient name, date, list of data elements, length of the monitoring service, enrollment deadline, and help line number are all left as unfilled fields, so the document does not state which personal information was in the affected files. This page does not guess at what those fields would say. Readers who received a completed letter should look there for the specific items that apply to them and for the deadline to enroll.
Billing vendors are attractive targets because they sit between many organizations and the people they serve. A vendor that processes billing for several clients can hold names, addresses, insurance details, account numbers, and service records for a large number of people, and a single intrusion can therefore reach customers of many separate organizations at once. When a service disruption is the first sign of trouble, it can also mean that a good deal of time has passed since the original access.
For people who receive a notice, the lesson is that information shared with an organization can end up held by companies they have never heard of. Reading the letter carefully, using the protections offered, and watching for fraud are sensible responses, especially since the notice does not rule out that sensitive identifiers were involved.
When Did This Breach Occur?
According to the notice, an unauthorized third party first gained access to the vendor’s systems on or around April 8, 2026, and potentially obtained customer information between June 4 and 8, 2026. Accumedic notified the Center on August 25, 2026 of a cyber incident that affected its systems.
The posted sample does not show the date of the letter sent to individuals, since the date field is blank in the template.
What Information Was Breached?
The notice says the affected files contained the recipient’s name and additional data elements, but the list of those elements is a blank placeholder in the sample posted with the Massachusetts Attorney General. The Center has not publicly disclosed a universal list of what was in the files.
Because the vendor handles billing services, the files could include a range of information that varies from person to person. Readers who received a completed letter should check it for the items that apply to them.
What You Can Do
If you received this notice, consider the following steps.
- Enroll in the free credit monitoring and identity restoration services offered through Epiq, using the activation code and deadline printed in your letter.
- Review the steps in your letter for placing a fraud alert or security freeze, and consider a free freeze with Equifax, Experian, and TransUnion.
- Review your credit reports at annualcreditreport.com and look over bank, card, and insurance statements for activity you do not recognize.
- Be cautious with unexpected emails, texts, and calls that mention the Center, billing, or this incident, and do not share passwords or financial details in response.
- Report suspected identity theft to the Federal Trade Commission at IdentityTheft.gov and to your state Attorney General, and keep your letter.
File a Data Breach Lawsuit Against The Center for Discovery
People whose personal information is exposed in a data security incident may have legal options if the organization or its vendor did not use reasonable safeguards to protect it. Whether a claim exists depends on the facts, including what information was involved, how the incident happened, and how the organizations responded.
If you received a notice from The Center for Discovery, you can speak with a lawyer about whether you may be able to join a class action lawsuit to seek compensation for the exposure of your information, the time you spent responding, and any losses you suffered.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
