HackingHealthcareHealthcareSupply Chain (3P Vendor)Business Associate (HIPAA)Data ExfiltratedCustomer Data InvolvedDelayed DiscoveryPHIIdentity (basic)Government IDHealth (basic)MediumContained

Ocracoke Health Center, Inc.

bd_0493365393dd47c7 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Jul 7, 2026

Filed

Sep 16, 2026

To disclose

10 weeks

Affected

4state residents only

Linked

3 filings

Confidence

69%

Full breach record for Ocracoke Health Center, Inc. →

Ocracoke Health Center, Inc. notified the NH Attorney General of a data security incident at its business associate, Aesto, LLC. An unauthorized actor accessed protected health information (including SSNs, diagnoses, and contact info) of 4 New Hampshire residents between Dec 2 and Dec 18, 2025. Aesto detected the incident on Dec 18, 2025, and contained it. Forensic investigation confirmed access/exfiltration. Residents were notified on Sept 16, 2026, and offered identity monitoring. Aesto remediated by closing security gaps, rotating credentials, and deleting impacted AWS Lambda functions.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 217 days

discovery → filing · 10 weeks / 71 days

Dec 2, 2025

Begins

Jul 7, 2026

Discovered

Sep 16, 2026

Filed

vs. sector median

+1 wks slower

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Vermont State AGbd_04282799b1fd0a752026-09-16Verified
Massachusetts State AGbd_16687a054c6acc6d2026-09-01 · +15dCandidate

Name: Ocracoke Health Center, Inc.
norm: ocracoke health center

Name: Ocracoke Health Center, Inc.
norm: ocracoke health center
Industry: Healthcarellm

Discovered: Jul 7, 2026
Breach occurred: Dec 2, 2025 – Dec 18, 2025
Undetected for: 217 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 16, 2026
Affected individuals: 4state-resident count only
Data types: PHIIdentity (basic)Government IDHealth (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified the New Hampshire Attorney General
Third party: via Aesto, LLC

During the incident: Contained the incident
Commenced a thorough investigation
Engaged leading cybersecurity experts
Performed extensive forensic investigation and manual document review
Notified affected individuals via first-class United States mail
Offered complimentary identity theft protection services to individuals whose Social Security numbers were involved
Changes made: Remediated the affected environment
Reset or rotated affected credentials
Enhanced monitoring
Implemented additional measures designed to prevent similar activity
Closed the security gaps exploited by the threat actor
Deleted the impacted Lambda functions
Rotated all impacted AWS secrets
Deleted unauthorized files uploaded by the threat actor
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(71 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGSep 1 · first

Vermont State AG+15d

New Hampshire State AG+15d · this page

Pattern: first filing Sep 1 (MA), last Sep 16 (NH) — a 15-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ocracoke-health-center-20260916.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 16, 2026
Raw hash: ea3953e8c757424771cb97483e295896fd272c014d80ca16a19868a77d520433

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityOcracoke Health Center, Inc.

Victim entityOcracoke Health Center, Inc.

Incidentdiscovered Jul 7, 2026

Stated responseContained the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov