HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedDelayed DiscoveryPIIPHIIdentity (basic)LowContained

The Cooper Health System

bd_0e52e3d43f302b7c · schema v1 · pii pii-v1

Severity

Low

Discovered

May 1, 2024

Filed

May 23, 2025

To disclose

13 months

Affected

1state residents only

Linked

4 filings

Confidence

66%

Full breach record for The Cooper Health System →2 incidents on file

The Cooper Health System notified the NH Attorney General of a data security incident discovered in May 2024. Unauthorized actors may have acquired personal and protected health information. One NH resident was notified. Cooper engaged cybersecurity experts and is offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 13 months / 387 days

May 1, 2024

Discovered

Mar 26, 2025

Scope determined

May 23, 2025

Filed

vs. sector median

+44 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_12fc54c1204931472025-05-23Verified
HHS OCRbd_1334d8b37970129d2025-05-23Verified
Maine State AGbd_e7c6f6c60497b58e2025-05-23Verified

Name: The Cooper Health System
norm: the cooper health system

Name: The Cooper Health System
norm: the cooper health system
Industry: Healthcarellm

Discovered: May 1, 2024
Materiality determined: Mar 26, 2025
Notification sent: May 23, 2025
Affected individuals: 1state-resident count only
Data types: PIIPHIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Attorney General John Formella
Initial access: valid_credentials

During the incident: Took immediate steps to secure its environment
Launched an investigation
Engaged independent cybersecurity experts to conduct an investigation
Undertook a detailed review of the affected files
Offering complimentary credit and identity protection monitoring services
Changes made: Implementing additional security protocols
Implemented measures to enhance network security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 months(387 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGMay 23 · first

HHS OCRMay 23 · first

Maine State AGMay 23 · first

New Hampshire State AGMay 23 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cooper-health-system-20250523.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 23, 2025
Raw hash: 5cdaa580ddd5ab776192812b3e6d55b8181566fcf69e1336c9ba3278ff19f6c3

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityThe Cooper Health System

Victim entityThe Cooper Health System

Incidentdiscovered May 1, 2024

Stated responseTook immediate steps to secure its environment

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov