HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedGovernment IDIdentity (basic)PHIMediumContained

Coastal Carolina Health Care, PA

bd_067b0d28c4df5e8b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 28, 2025

Filed

Mar 24, 2026

To disclose

52 weeks

Affected

34state residents only

Linked

4 filings

Confidence

66%

Full breach record for Coastal Carolina Health Care, PA →2 incidents on file

New Hampshire Attorney General notice regarding Coastal Carolina Health Care, PA. Unauthorized access occurred March 21-27, 2025, discovered March 28, 2025. 34 NH residents affected; names and SSNs exposed. Unknown actor. FBI notified. Remediation includes forensic investigation, security hardening, and 12 months of credit monitoring via Cyberscout/TransUnion.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 7 days

discovery → filing · 52 weeks / 361 days

Mar 21, 2025

Begins

Mar 28, 2025

Discovered

Mar 24, 2026

Filed

vs. sector median

+40 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_2b577f4dc04bcee22026-03-24Candidate
HHS OCRbd_5f289ed36ffb59982026-03-24Verified by operator
Nebraska State AGbd_1edc9fedb96f0c352026-03-23 · +1dVerified by operator

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Name: Coastal Carolina Health Care, PA
norm: coastal carolina health care
Industry: healthcare
Industry: Healthcarellm

Discovered: Mar 28, 2025
Breach occurred: Mar 21, 2025 – Mar 27, 2025
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 23, 2026
Affected individuals: 34state-resident count only
Data types: Government IDIdentity (basic)PHI
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1119 Automated Collection
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General's Office

During the incident: Engaged a leading, independent cybersecurity firm to investigate
Engaged a third-party vendor to conduct a comprehensive review of the affected data
Notified the Federal Bureau of Investigation and will cooperate with any resulting investigation
Implemented additional security measures to further harden its digital environment
Notified the affected individuals via First Class U.S. mail
Offered complimentary identity protection services through Cyberscout, a TransUnion company
Changes made: Implemented additional security measures to further harden its digital environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 52 weeks(361 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Nebraska State AGMar 23 · first

Massachusetts State AG+1d

HHS OCR+1d

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/coastal-carolina-health-care-20260324.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 24, 2026
Raw hash: 80bb7dee954e70cbe5c50f3a22ff8fbe647d3d75eac0eb0d824dd911c3cb7aeb

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityConstangy, Brooks, Smith & Prophete, LLP

Victim entityCoastal Carolina Health Care, PA

Incidentdiscovered Mar 28, 2025

Stated responseEngaged a leading, independent cybersecurity firm to investigate

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov