HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)MinorHighContained

Moses-Weitzman Health System, Inc.

bd_06c323e4f068c974 · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 2, 2025

Filed

Jan 30, 2025

To disclose

28 days

Affected · nationwide

3,7665 in this filing

Linked

6 filings

Confidence

66%

Full breach record for Moses-Weitzman Health System, Inc. →3 incidents on file

Moses-Weitzman Health System, Inc. disclosed an external system breach (hacking) occurring on October 14, 2024, discovered on January 2, 2025. A sophisticated criminal actor accessed the IT environment and exfiltrated data including names, SSNs, DOBs, health insurance info, and government IDs. 3,766 individuals affected (5 in Maine). Notices sent January 30, 2025, offering 24 months of identity protection.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jan 2, 2025 → Filed with AG Jan 30, 202528d ✓ ME AG ≤30d28 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 80 days

discovery → filing · 28 days

Oct 14, 2024

Begins

Jan 2, 2025

Discovered

Jan 30, 2025

Filed

vs. sector median

9 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

New Hampshire State AGbd_5a05001fa8c1ba752025-01-30Verified
Maryland State AGbd_abcbf8032b31cc542025-01-30Verified
Indiana State AGbd_b72ef11708d0139a2025-01-30Verified
Vermont State AGbd_de0962eda247ff492025-01-30Verified

Show 1 more filing ↓up to 1d gap

Massachusetts State AGbd_1d7b89a7219d3dfa2025-01-31 · +1dVerified

Name: Moses-Weitzman Health System, Inc.
norm: moses weitzman health system

Name: Moses-Weitzman Health System, Inc.
norm: moses weitzman health system
Industry: Healthcarellm

Discovered: Jan 2, 2025
Breach occurred: Oct 14, 2024
Undetected for: 80 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 30, 2025
Affected individuals: 3,766state + nationwide
Data types: Identity (basic)Government IDHealth (basic)Minor
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Filed data breach notice with the Maine Attorney General
Initial access: exploit_public_facing

During the incident: Retained a leading independent forensics firm to conduct a thorough investigation and reinforce the security of our systems
Deployed sophisticated software to each of our endpoints to monitor the environment for any suspicious activity
Offering identity theft protection services through IDX, A ZeroFox Company
Sent written notification to affected individuals
Changes made: Deployed sophisticated software to each of our endpoints to monitor the environment for any suspicious activity
Taking additional steps to protect data from theft or similar criminal activity in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: ME AG ≤30d · 28d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jan 2, 2025
→ Filed with AG: Jan 30, 2025
28d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jan 2, 2025 → Filed with AG: Jan 30, 2025	28d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

New Hampshire State AGJan 30 · first

Maryland State AGJan 30 · first

Indiana State AGJan 30 · first

Vermont State AGJan 30 · first

Maine State AGJan 30 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/5528388f-10f4-4b5a-b23e-a68ff430cec1.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 30, 2025
Raw hash: ad32883f15e9275c5fa8a23090d567e5ee40ccdb17a53372230f747fc9c42655

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMoses-Weitzman Health System, Inc.

Victim entityMoses-Weitzman Health System, Inc.

Incidentdiscovered Jan 2, 2025

Stated responseRetained a leading independent forensics firm to conduct a thorough investigation and reinforce the security of our systems

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov