HackingHealthcareHealthcareVulnerability ExploitData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)MediumContained

Warren General Hospital

bd_0093aa35975521df · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 24, 2023

Filed

Nov 17, 2023

To disclose

8 weeks

Affected

69state residents only

Linked

5 records

Confidence

66%

Full breach record for Warren General Hospital →2 incidents on file

Warren General Hospital notified New Hampshire residents of a data breach where an unknown actor accessed systems between Sept 15-23, 2023, downloading patient and employee data including SSNs, financial info, and medical records. 69 NH residents were notified on Nov 17, 2023. The hospital engaged forensic specialists, reported to federal law enforcement, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 9 days

discovery → filing · 8 weeks / 54 days

Sep 15, 2023

Begins

Sep 24, 2023

Discovered

Nov 17, 2023

Filed

vs. sector median

1 wks faster

This filing is one of 5 records about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteransomhousebd_520bc414886878b02023-09-23 · +55dVerified by operator

Regulatory filings (3) · sorted by filing gap

Vermont State AGbd_1924dfe0062bd3f12023-11-17Verified
Massachusetts State AGbd_b2c0ad837f45658a2023-11-17Verified
HHS OCRbd_d03a06da70bd116f2023-11-09 · +8dVerified

Name: Warren General Hospital
norm: warren general hospital
Domain: wgh.org

Name: Warren General Hospital
norm: warren general hospital
Domain: wgh.org
Industry: Healthcarellm

Discovered: Sep 24, 2023
Breach occurred: Sep 15, 2023 – Sep 23, 2023
Undetected for: 9 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 17, 2023
Affected individuals: 69state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: provided initial notice of this event to the U.S. Department of Health and Human Servicesprovided supplemental notice to the U.S. Department of Health and Human Servicesprovided written notice to appropriate state privacy regulatorsprovided written notice to the three major consumer reporting agencies, Equifax, Experian, and TransUnion
Initial access: exploit_public_facing

During the incident: Moved quickly to investigate and respond
Assess the security of WGH systems
Identify potentially affected individuals
Promptly reported the event to federal law enforcement
Implemented additional administrative and technical safeguards
Providing access to credit monitoring services for , through CyEx to individuals whose personal information was potentially affected by this event, at no cost to these individuals
Established a toll-free assistance telephone line to address questions from notified individuals related to the event
Changes made: Reviewed existing policies and procedures
Enhanced administrative and technical controls
Provided additional security training to reduce the likelihood of a similar future event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(54 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

HHS OCRNov 9 · first

Vermont State AG+8d

Massachusetts State AG+8d

New Hampshire State AG+8d · this page

Pattern: first filing Nov 9 (PA), last Nov 17 (NH) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/warren-general-hospital-20231117.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 17, 2023
Raw hash: 6a1b16a44b32eddf460aa6ef5c3ae0fd64f53e71a412d42bc38b4471bcfefb0b

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityWarren General Hospital

Victim entityWarren General Hospital

Incidentdiscovered Sep 24, 2023

Stated responseMoved quickly to investigate and respond

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov