HackingHealthcareHealthcareCustomer Data InvolvedIdentity (basic)Government IDPHIHealth (basic)MediumContained

Heart of America Medical Centr (HAMC)

bd_022d693af1698273 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 12, 2025

Filed

Aug 3, 2026

To disclose

14 months

Affected

2state residents only

Linked

5 records

Confidence

66%

Full breach record for Heart of America Medical Centr (HAMC) →

Heart of America Medical Center detected suspicious network activity on June 12, 2025, leading to unauthorized access by a third party. The incident potentially compromised personal information, including names, addresses, dates of birth, Social Security Numbers, and clinical/health insurance data. Two New Hampshire residents were affected. The organization isolated systems, engaged forensic investigators, and is offering credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d14 months discovery → filing

Incident timeline

discovery → filing · 14 months / 417 days

Jun 12, 2025

Discovered

Aug 3, 2026

Filed

vs. sector median

+51 wks slower

This filing is one of 5 records about the same incident.View merged incident

A leak claim by embargo about this victim was first seen 362 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteembargobd_32722b227875d4a82025-07-17 · +381dVerified by operator

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_ef94e5aa560311752026-08-04 · +1dVerified by operator
Massachusetts State AGbd_3c62369826bbda142026-08-01 · +2dVerified by operator
HHS OCRbd_af62c0d23a5dedb32025-07-01 · +398dCandidate

Name: Heart of America Medical Center
norm: heart of america medical center
Domain: wilsonelser.com

Name: Heart of America Medical Centr (HAMC)
norm: heart of america medical centr hamc
Domain: heartofamericamedicalcenter.org
Industry: Healthcarellm

Discovered: Jun 12, 2025
Materiality determined: —
Notification sent: Aug 4, 2026
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDPHIHealth (basic)
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Immediately isolated the impacted environment
Worked with IT professionals and outside experts to secure and remediate the server
Engaged a third-party cybersecurity firm to conduct a comprehensive forensic investigation
Conducted an extensive review of the impacted data files
Provided substitute notice through a website posting and media notice on September 20, 2025
Engaged a third-party vendor to identify potentially impacted individuals
Implemented additional technical safeguards
Implemented enhanced security measures
Updated policies and procedures
Offering 12 months of access to Single Bureau Credit Monitoring services at no charge
Changes made: Implemented additional technical and administrative steps to further enhance the security of its systems
Implemented security enhancements including updates to security technologies and vendors
Expanded employee security awareness training
Completed comprehensive internal and external security testing
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 months(417 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

HHS OCRJul 1 · first

Massachusetts State AG+396d

New Hampshire State AG+398d · this page

Indiana State AG+399d

Pattern: first filing Jul 1 (ND), last Aug 4 (IN) — a 399-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/heart-america-medical-center-20260803.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 3, 2026
Raw hash: 99612ac193969e17a28e659cde3f8bf10b418140599dd1ba9fc374bcc7988fa7

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityHeart of America Medical Center

Victim entityHeart of America Medical Centr (HAMC)

Incidentdiscovered Jun 12, 2025

Stated responseImmediately isolated the impacted environment

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov