On October 5, 2026, Access Residential Management reported a data security incident to two state regulators on the same day. Massachusetts logged it as breach 2026-1713 in the 2026 Data Breach Notification Report: 7 Massachusetts residents affected, SSN Breached Yes, Financial Account Breached Yes, Drivers Licenses Breached Yes, Medical Records Breached No. The Vermont Attorney General's table logged it the same day: 2 Vermont residents, and under Categories of Data Breached, one entry — Health Information. The sample letter filed in Massachusetts describes no incident, which is what Massachusetts law requires of it.
Access Residential Management is a Florida community association manager: its own site describes founder and president Barry J. Caplan as running "a 'hospitality focused' Community Association Management Company," licensed in the state. As of October 13, 2026 no source establishes how the intrusion happened, and the company appears nowhere in the ransomware.live bulk leak-post dataset.
Two rows, one incident
The rows look contradictory: Massachusetts says medical records were not breached, Vermont says health information was. Neither is wrong, and the reason matters more than the discrepancy.
Each row covers only that state's residents — 7 people in Massachusetts, 2 in Vermont, nine data subjects out of an unknown total. A category can be false for one population and true for the other in the same incident.
The schemas differ too. Massachusetts publishes a fixed five-column grid — SSN, Medical Records, Financial Account, Drivers Licenses, Credit/Debit Numbers — so all it can express about health data is Yes or No against the words "Medical Records." Vermont's column is free text headed "Categories of Data Breached," and the filer wrote "Health Information," where other rows in the same table say "Health Records." Nothing here produces an inventory of what a vendor held: the unit of reporting is affected residents of one state under that state's taxonomy, so any single filing is a sample.
The practice: union the filings, then go after retention
When a vendor in your supply chain files, read every state it filed in and union the data-type columns instead of trusting the first row you find. Massachusetts puts the whole year in one searchable PDF, Vermont publishes an HTML table, California publishes the notification letters themselves, and Maine and Indiana publish searchable lists. The cost is an hour of manual work, no API, and the union is a floor, not a total — a state where the vendor had no residents produces no row.
A community association manager holds Social Security numbers, driver license numbers, bank details and health information because someone's process required each one — and Florida law names the processes. Section 720.303(5)(g) of the Florida Statutes ends with a list of official records that "are not accessible to members or parcel owners." Read as a holdings list, not an inspection exemption, it is close to the breach filing: "Information obtained by an association in connection with the approval of the lease, sale, or other transfer of a parcel"; "Information an association obtains in a gated community in connection with guests' visits"; "Medical records of parcel owners or community residents"; and "Social security numbers, driver license numbers, credit card numbers."
None of those collection points carries an expiry date, and s. 720.303(4)(a) runs the other way: official records must be kept "for at least 7 years, unless the governing documents of the association require a longer period of time." Practice adds ACH mandates for assessment auto-debit and reasonable-accommodation and assistance-animal files, a records class almost nobody scopes under property management. Those are the general case for the industry; nothing published says which of them held the data here.
So the useful question is not whether the vendor encrypts, but which categories could be deleted tomorrow without breaking an operation — and for a 2019 screening file on an applicant who never moved in, usually all of it. The cost sits there, because deletion breaks things when the dependency is wrong: estoppel letters, collections, litigation hold, the 7-year floor. The workable version is a per-category retention clock signed off by counsel, plus one rule for records you cannot delete yet — move them into a store with different credentials and no application path to it. Shrinking the live set also shortens your own notification timeline, which is a data inventory problem long before it is a legal one.
What to check this week
- For each vendor holding personal data on your behalf, search the Massachusetts annual report and the Vermont table for its name, and union the data-type columns across every state with a row.
- Count the categories of personal data in your systems that exist because a process once needed them, and find the oldest record in each.
- For each category, write down what breaks if that oldest record is deleted. Where the answer is "nothing," the problem is retention, not security.
- Check whether your vendor inventory includes the vendors your counterparties chose — the board, the franchisor, the association — not only the ones you signed with; it is the same gap that opens when a managed IT provider is breached.
- If you are an owner or a board member, ask the management company in writing which of those four categories it holds and for how long. Nobody in the community signed a contract with it, and the answer estimates your exposure to a vendor you will never audit.
North InfoSec runs AI-assisted penetration testing and security assessments, including the third-party and data-concentration review described above. northinfosec.com