Mazzola Mardon Data Breach 2026: 2,123 Longshoremen Health Fund Members Exposed. ERISA Law Firm Business Associate. What To Do

What happened

Mazzola Mardon, P.C. (formally Marrinan & Mazzola Mardon, P.C., founded 1955) is not a medical practice. It is a New York labor and ERISA law firm at 26 Broadway, Floor 17, New York, NY. The firm appears on the HHS OCR breach portal because it serves as ERISA counsel — a HIPAA business associate — to the Management-ILA Managed Health Care Trust Fund (MILA), a multiemployer Taft-Hartley health and welfare fund providing medical, behavioral health, and prescription drug benefits to International Longshoremen’s Association members and management.

On August 8, 2025, an unauthorized actor accessed Mazzola Mardon’s network and exfiltrated files. The firm completed its file review on January 27, 2026 (~5 months of analysis). Individual notification letters were mailed on March 23, 2026, and the substitute breach notice was issued and HHS OCR filing made on April 15, 2026 — confirming 2,123 affected individuals.

The 220-day gap from intrusion to notice is at the long end of acceptable under HIPAA. No ransomware group has publicly claimed responsibility; no leak-site listing has been observed.

Why this filing names a law firm, not a doctor’s office

The HHS OCR listing under “Mazzola Mardon, P.C.” can mislead readers into expecting a medical practice. The actual covered entity is the Management-ILA Managed Health Care Trust Fund. Mazzola Mardon is the business associate — the legal counsel — that held a copy of fund member records as part of its ERISA representation.

This is a law-firm-as-business-associate breach affecting an ILA longshoremen’s health fund, not a clinical-care breach.

What was stolen

Per the substitute notice:

• Full name, home address, date of birth
• Social Security number
• Driver’s license / state ID
• Financial account information
• Mental or physical condition
• Treatment / diagnosis information
• Dates of service, provider name, procedure type
• Prescription information
• Medical record number
• Medicare ID
• Health insurance information
• Billing / claim information

The combination of SSN + financial account + mental health + Medicare ID is a particularly sensitive exposure profile.

What Mazzola Mardon is offering

Public reporting does not confirm a complimentary credit monitoring program. Given the SSN + financial account + Medicare ID exposure, the industry standard would be 12-24 months of credit monitoring. Read your specific notification letter carefully — the offer (if any), enrollment instructions, and call center number will be listed there.

What to do

1. Read your specific notification letter to confirm what data elements were involved and what monitoring is offered.
2. If you are an ILA longshoreman, ILA management employee, or a dependent, check your MILA member portal for guidance and contact MILA directly.
3. Place free credit freezes at Equifax, Experian, TransUnion. Full SSN, driver’s license, and financial account are all in scope.
4. File IRS Form 14039.
5. Watch your Medicare Summary Notice for unfamiliar claims.
6. Stop the ongoing flow of your fund member data. HealthConsent files HIPAA restriction requests covering Taft-Hartley fund administration and ERISA business-associate pathways.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches