Re: Notification of Security Breach of Information

We would like to inform you of a breach of the security of certain electronic protected health information (“PHI”) that Gardiner Family Chiropractic (“GFC”) maintains about you. GFC was the victim of a ransomware attack, which affected our electronic data that may have included information about you. This notice is being provided to you under the federal Health Insurance Portability and Accountability Act (“HIPAA”) Breach Notification Rule and Maine’s Notice of Risk to Personal Data Act.

On July 17, 2026, GFC discovered that a breach of the security of certain PHI that GFC maintains occurred as a result of a ransomware attack. While it is unclear if this ransomware attack was initiated on the same day it was discovered, any access the ransomware attackers had to GFC’s systems was suspended shortly after discovery. Ransomware is a type of malicious software that attempts to deny access to data. In this case, the ransomware was encrypting GFC’s data so that GFC could not access it and included a demand that GFC pay a ransom to regain access to its data. GFC did not pay the ransom and was able to stop the attack.

GFC undertook a prompt investigation of the incident and has determined that the following types of PHI and/or personal information concerning 5,000 individuals may have been compromised as a result of this incident, including: names, addresses, other contact information, dates of birth, health care information, and insurance/MaineCare information.

As a result of the attack, GFC took the following steps to investigate and mitigate the risks of harm, and reduce the risk of future attacks:

• GFC’s leadership and information technology employees investigated the scope of the attack and promptly moved to a new secure server.

• GFC wiped the affected computers and purchased new computers for its staff to use going forward.

• GFC also reviewed its systems, policies, and procedures and implemented additional security measures to reduce the likelihood of an attack like this from occurring in the future. These measures included implementing extra layers of security for our servers and providing special training for our employees on ransomware.

Because of this ransomware attack that affected GFC systems, which may have contained your information, we are notifying you about this breach in an abundance of caution and recommend that you take the following steps to reduce your risk of identity theft:

1. Call the toll-free numbers or go to the websites of any one of the three major credit bureaus (below) to place a fraud alert on your credit report. This can help prevent an identity thief from opening additional accounts in your name. As soon as the credit bureau confirms your fraud alert, the other two credit bureaus will automatically be notified to place alerts on your credit report, and all three reports will be sent to you free of charge:

• Equifax

Toll-Free Number: (800) 525-6285

Website:https://www.equifax.com/personal/credit-report-services/credit-fraud-alerts/‍ ‍

• Experian

Toll-Free Number: (888) 397-3742

Website: https://www.experian.com/fraud/center.html

• TransUnion

Toll-Free Number: (800) 680-7289

Website: https://www.transunion.com/fraud-alerts

2. Order your credit reports. By establishing a fraud alert, you will receive information that will explain how you can receive a free copy of your credit report. When you receive your credit report, examine it closely and look for signs of fraud, such as accounts you did not open.

3. Continue to monitor your credit reports. Even though a fraud alert has been placed on your account, you should continue to monitor your credit reports to ensure an imposter has not opened an account with your personal information.

4. Closely monitor your bank statements and other financial information. If you believe that fraudulent activity is occurring, immediately contact your financial institutions.

5. When you file your federal income tax return you should also complete and attach Form 14039, the Identity Theft Affidavit. For assistance or more information, you may call the IRS at (800) 908-4490.

*

If you have any questions or would like more information about this incident, please contact us at:

Gardiner Family Chiropractic

Attention: Privacy Officer

90 Main Ave

Gardiner, ME 04345

Tel.: (800) 972-3864

Email: gfc@gardinerfamilychiropractic.com

Website: https://www.gardinerfamilychiropractic.com/

We deeply regret that this incident occurred, and want to assure you that we take it and the privacy and security of the information we maintain about you very seriously and are working to ensure that this sort of incident does not occur again.

Sincerely,

Jennifer L. Johnson DC and Richard W. Knipping, DC,

and all of the Gardiner Family Chiropractic staff