The Middlesex Sheriff’s Office (MSO) is today providing official public notice of the results of an investigation into a breach of security that occurred in January 2025.
Over the past year, the MSO has worked closely with state and federal law enforcement partners including the Federal Bureau of Investigation, the Massachusetts State Police, the Commonwealth Fusion Center and the Massachusetts Executive Office of Technology Services and Security, and two (2) leading private cybersecurity vendors to determine the extent of this event.
This comprehensive investigation and review has determined that the breach involved unauthorized access to protected health information of individuals the MSO may have previously provided medical care to. The protected health information involved varied by individual and may have included the affected individual’s name, address, date of birth, diagnoses and/or other general health information. The MSO is not aware of any unauthorized use of protected health information and has since secured the affected systems, implementing additional security measures to safeguard protected health information.
As a result of this determination, the Middlesex Sheriff’s Office strongly encourages individuals whose information may have been accessed to monitor their credit reports, consider a fraud alert, and review their personal information such as bank statements and insurance records for any signs of fraud to protect themselves from potential harm.
The Middlesex Sheriff’s Office has posted information regarding this incident, including steps individuals may take to request a free security freeze on their credit reports on its website at www.middlesexsheriff.org.
Members of the public who are concerned about whether their information may have been accessed may contact the MSO at cyberinquiry@sdm.state.ma.us.
###
Dear Sir/Madam,
We are writing to notify you that a breach of security occurred in January of 2025 at the Middlesex Sheriff’s Office (“MSO”). Since that time, the MSO has worked closely with state and federal law enforcement partners including the Federal Bureau of Investigation, the Massachusetts State Police, the Commonwealth Fusion Center and the Executive Office of Technology Services and Security, and two (2) leading private cybersecurity vendors to determine the extent of this event.
A comprehensive review and investigation into the security breach has since determined on November 19, 2025 that the breach of security involved unauthorized access to your protected health information. The protected health information involved in the security breach may have included your name, addresses, date of birth, diagnoses and/or other general health information. The MSO is not aware of any unauthorized use of your protected health information and has since secured the affected systems and implemented additional security measures to safeguard your protected health information.
The MSO strongly encourages you to monitor your credit reports, consider a fraud alert, and review your personal information such as bank statements and insurance records for any signs of fraud to protect yourself from potential harm.
You may also place a security freeze on your credit reports, free of charge. A security freeze prohibits a credit reporting agency from releasing any information from a consumer’s credit report without written authorization. However, please be aware that placing a security freeze on your credit report may delay, interfere with, or prevent the timely approval of any requests you make for new loans, credit mortgages, employment, housing or other services. Under federal law, you cannot be charged to place, lift, or remove a security freeze.
You must place your request for a freeze with each of the three (3) major consumer reporting agencies: Equifax (www.equifax.com); Experian (www.experian.com); and TransUnion (www.transunion.com). To place a security freeze on your credit report, you may send a written request by regular, certified or overnight mail at the addresses below. You may also place a security freeze through each of the consumer reporting agencies’ websites or over the phone, using the contact information below:
Equifax Security Freeze Experian Security Freeze
P.O. Box 105788 P.O. Box 9554
Atlanta, GA 30348 Allen, TX 75013
1-800-349-9960 1-888-397-3742
https://www.equifax.com/personal/credit-report-services/ https://www.experian.com/freeze/center.html
TransUnion Security Freeze
P.O. Box 160
Woodlyn, PA 19094
1-888-909-8872
https://www.transunion.com/credit-freeze
In order to request a security freeze, you will need to provide some or all of the following information to the credit reporting agency, depending on whether you do so online, by phone, or by mail:
1. Your full name (including middle initial as well as Jr., Sr., II, III, etc.);
2. Social Security Number;
3. Date of birth;
4. If you have moved in the past five (5) years, the addresses where you have lived over the prior five years;
5. Proof of current address, such as a current utility bill, telephone bill, rental agreement, or deed;
6. A legible photocopy of a government issued identification card (state driver’s license or ID card, military identification, etc.);
7. Social Security Card, pay stub, or W2;
8. If you are a victim of identity theft, include a copy of either the police report, investigative report, or complaint to a law enforcement agency concerning identity theft.
The credit reporting agencies have one (1) to three (3) business days after receiving your request to place a security freeze on your credit report, based upon the method of your request. The credit bureaus must also send written confirmation to you within five (5) business days and provide you with a unique personal identification number (PIN) or password (or both) that can be used by you to authorize the removal or lifting of the security freeze. It is important to maintain this PIN/password in a secure place, as you will need it to lift or remove the security freeze.
To lift the security freeze in order to allow a specific entity or individual access to your credit report, you must make a request to each of the credit reporting agencies by mail, through their website, or by phone (using the contact information above). You must provide proper identification (including name, address, and social security number) and the PIN number or password provided to you when you placed the security freeze, as well as the identities of those entities or individuals you would like to receive your credit report. You may also temporarily lift a security freeze for a specified period of time rather than for a specific entity or individual, using the same contact information above. The credit bureaus have between one (1) hour (for requests made online) and three (3) business days (for request made by mail) after receiving your request to lift the security freeze for those identified entities or for the specified period of time.
To remove the security freeze, you must make a request to each of the credit reporting agencies by mail, through their website, or by phone (using the contact information above). You must provide proper identification (name, address, and social security number) and the PIN number or password provided to you when you placed the security freeze. The credit bureaus have between one (1) hour (for requests made online) and three (3) business days (for requests made by mail) after receiving your request to remove the security freeze.
Should you have any further questions concerning this incident, please contact Cyberinquiry@sdm.state.ma.us