HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PHICriticalContained

Egyptian Health Department

bd_0f5c12539b22d504 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Dec 21, 2023

Filed

Jul 2, 2024

To disclose

28 weeks

Affected · nationwide

121,9951 in this filing

Linked

4 filings

Confidence

66%

Full breach record for Egyptian Health Department →2 incidents on file

Egyptian Health Department (EHD), a behavioral health provider in Illinois, disclosed a cybersecurity incident discovered on December 21, 2023. Unauthorized access to EHD's network exposed names, addresses, DOBs, SSNs, financial account info, and medical/health information of approximately 121,995 individuals. EHD engaged forensic investigators, secured the network, and offered 12 months of credit monitoring. One Maine resident was notified.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Dec 21, 2023 → Filed with AG Jul 2, 2024194d ⏱ ME AG >30d28 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 28 weeks / 194 days

Dec 21, 2023

Begins

Dec 21, 2023

Discovered

Jul 2, 2024

Filed

vs. sector median

+19 wks slower

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_2bf347e7618aeefb2024-07-02Candidate
Indiana State AGbd_c2b88daf4735388a2024-07-02Verified
Massachusetts State AGbd_d409e760cd66e4472024-07-02Verified

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: Egyptian Health Department
norm: egyptian health department
Industry: Healthcarellm

Discovered: Dec 21, 2023
Breach occurred: Dec 21, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 2, 2024
Affected individuals: 121,995state + nationwide
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Maine Attorney General
Initial access: exploit_public_facing

During the incident: Disconnected all access to the network
Engaged a specialized third-party cybersecurity firm to assist with securing the environment
Conducted a comprehensive forensic investigation
Engaged a specialized cybersecurity firm and IT personnel to conduct a forensic investigation
Created new domain controllers
Implemented new technical safeguards
Offered 12 months of complimentary credit monitoring and identity theft restoration services through Cyberscout, a TransUnion company
Changes made: Created new domain controllers
Moved the SMB network shares off the domain controllers to a dedicated virtual machine
Implemented permission audits on shared folders
Limited Sharepoint Server to internal access only
Reset all credentials
Moved programs requiring inbound initiated connections to individual virtual machines
Installed Sentinel One and Huntress on all equipment
Implemented limited use access to Domain Admin rights
Implemented password protection on spreadsheets with PHI
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(194 days from discovery to filing)
Compliance flags: ME AG >30d · 194dME resident >60d · 194d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Dec 21, 2023
→ Filed with AG: Jul 2, 2024
194d 30 days (soft) ME AG >30d
Maine
Discovered: Dec 21, 2023
→ Notified: Jul 2, 2024
194d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Dec 21, 2023 → Filed with AG: Jul 2, 2024	194d	30 days (soft)	ME AG >30d
Maine	Discovered: Dec 21, 2023 → Notified: Jul 2, 2024	194d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGJul 2 · first

Indiana State AGJul 2 · first

Massachusetts State AGJul 2 · first

Maine State AGJul 2 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/5be16c16-838e-44d1-8422-b8f57fc9667c.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 2, 2024
Raw hash: eb5505cf5e2ed9ce4fffe4240ccfa860c80a71b551a50dd1a7a34231b31b2c8c

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityEgyptian Health Department

Incidentdiscovered Dec 21, 2023

Stated responseDisconnected all access to the network

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov