HackingHealthcareHealthcareSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountLowContained

MAIMONIDES MEDICAL CENTER

bd_0f3b73f1f60b2764 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 25, 2020

Filed

Dec 1, 2020

To disclose

10 weeks

Affected

3state residents only

Linked

2 filings

Confidence

66%

Full breach record for MAIMONIDES MEDICAL CENTER →2 incidents on file

Maimonides Medical Center notified the New Hampshire Attorney General of a data security incident involving third-party vendor Blackbaud, Inc. Unauthorized access to Blackbaud's fundraising database occurred between February 7, 2020, and May 20, 2020. The incident exposed general demographic information and bank account/routing numbers for 3 New Hampshire residents. No Social Security numbers or electronic health records were compromised. Notifications were sent on November 30, 2020.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 231 days

discovery → filing · 10 weeks / 67 days

Feb 7, 2020

Begins

Sep 25, 2020

Discovered

Dec 1, 2020

Filed

vs. sector median

on median

This filing is one of 2 filings about the same incident.View merged incident

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_1050727602cb1d922020-11-30 · +1dVerified

Name: MAIMONIDES MEDICAL CENTER
norm: maimonides medical center
Domain: maimonidesmed.org

Name: MAIMONIDES MEDICAL CENTER
norm: maimonides medical center
Domain: maimonidesmed.org
Industry: Healthcarellm

Discovered: Sep 25, 2020
Breach occurred: Feb 7, 2020 – May 20, 2020
Undetected for: 231 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 30, 2020
Affected individuals: 3state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Third party: via Blackbaud, Inc.
Initial access: supply_chain

During the incident: Reviewed the specific contents of the database to determine what it contained
Mailed notification letters to the New Hampshire residents
Established a dedicated, toll-free call center
Changes made: Undertaking a review of how its information is stored with Blackbaud
Evaluating Blackbaud's security safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(67 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGNov 30 · first

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/maimonides-medical-center-20201201.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 1, 2020
Raw hash: fa1cd418ddc19080a30d69d9b88446116894bb960cdef07f40a6f60d6bac87c3

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMAIMONIDES MEDICAL CENTER

Victim entityMAIMONIDES MEDICAL CENTER

Incidentdiscovered Sep 25, 2020

Stated responseReviewed the specific contents of the database to determine what it contained

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov