HackingHealthcareHealthcareStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDHealth (basic)MediumContained

Lexington Medical Center

bd_09440adef3221e75 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 29, 2021

Filed

Mar 29, 2021

To disclose

8 weeks

Affected

2state residents only

Linked

2 filings

Confidence

66%

Lexington Medical Center notified New Hampshire AG of a third-party breach at vendor Healthgrades. Unauthorized access occurred Oct 16-28, 2020 to archived server containing backup files (2010-2011). Affected 2 NH residents with names, addresses, SSNs, and limited health info. Notification sent March 26, 2021, offering 1 year identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 105 days

discovery → filing · 8 weeks / 59 days

Oct 16, 2020

Begins

Jan 29, 2021

Discovered

Mar 29, 2021

Filed

vs. sector median

4 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_0256f8a6bd5b4f432021-03-26 · +3dVerified

Name: Lexington Medical Center
norm: lexington medical center

Name: Lexington Medical Center
norm: lexington medical center
Industry: Healthcarellm

Discovered: Jan 29, 2021
Breach occurred: Oct 16, 2020 – Oct 28, 2020
Undetected for: 105 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 26, 2021
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Notified law enforcement (via Healthgrades)
Initial access: valid_credentials

During the incident: Obtained assurances from Healthgrades that no LMC patient data remains on their systems
Reviewed its files and confirmed that no patient information is being sent to Healthgrades
Began mailing letters to the New Hampshire residents
Offering the notified residents one year of complimentary identity monitoring services through Kroll
Changes made: Obtained assurances from Healthgrades that no LMC patient data remains on their systems
Reviewed its files and confirmed that no patient information is being sent to Healthgrades
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGMar 26 · first

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/lexington-medical-20210329.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 29, 2021
Raw hash: e6fa4152ea15a901920b48dd810c1ccef6b867db3a5e5b39bbd1f9181b1bdb7d

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityLexington Medical Center

Victim entityLexington Medical Center

Incidentdiscovered Jan 29, 2021

Stated responseObtained assurances from Healthgrades that no LMC patient data remains on their systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov