HackingHealthcareHealthcareSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedPHIGovernment IDIdentity (basic)Health (basic)Financial accountMediumContained

Midwest Spine and Brain Institute

bd_101618adc3b7082d · schema v1 · pii pii-v2

Severity

Medium

Discovered

Nov 20, 2024

Filed

Aug 14, 2026

To disclose

21 months

Affected

3state residents only

Linked

3 filings

Confidence

66%

Full breach record for Midwest Spine and Brain Institute →

Midwest Spine and Brain Institute (MSBI) notified the NH Attorney General of a data breach affecting 3 NH residents. An unauthorized actor accessed the network of a third-party vendor (3C) on or about November 21, 2024. MSBI learned of the incident on November 20, 2024. Compromised data included PHI (medical records, diagnoses, treatments), PII (SSN, DOB, name), and health insurance information. MSBI engaged forensic experts, contained the threat, and is providing credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

Nov 21, 2024

Begins

Aug 14, 2026

Filed

vs. sector median

+78 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_b3d6ff59f37577552026-08-14Candidate
Massachusetts State AGbd_5ff6f124fb6f5ee12026-08-01 · +13dCandidate

Name: Midwest Spine and Brain Institute
norm: midwest spine and brain institute

Name: Midwest Spine and Brain Institute
norm: midwest spine and brain institute
Industry: Healthcarellm

Discovered: Nov 20, 2024
Breach occurred: Nov 21, 2024
Materiality determined: —
Notification sent: Aug 14, 2026
Affected individuals: 3state-resident count only
Data types: PHIGovernment IDIdentity (basic)Health (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Regulator citations: Notified the New Hampshire Attorney General
Initial access: supply_chain

During the incident: Immediately launched an investigation in consultation with legal counsel and cybersecurity experts
Consulted with the vendor to ensure they contained the threat and secured their environment
Commenced a prompt and thorough investigation into the incident
Worked closely with external cybersecurity professionals experienced in handling these types of situations
Conducted an extensive forensic investigation and complex manual document review
Providing the affected residents with written notification of this incident
Providing contact information of the consumer reporting agencies and the Federal Trade Commission
Providing a complimentary one-year membership with a credit monitoring service upon request for the individual whose Social Security Number was involved
Changes made: Continually evaluates and modifies its practices and internal controls to enhance the security and privacy of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 months(632 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGAug 1 · first

HHS OCR+13d

New Hampshire State AG+13d · this page

Pattern: first filing Aug 1 (MA), last Aug 14 (NH) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/midwest-spine-brain-institute-20260814.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 14, 2026
Raw hash: 3edb6e5bbda59f24183e53261044a2d04b3e11e4394fa6cecf864aec1c53e902

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMidwest Spine and Brain Institute

Victim entityMidwest Spine and Brain Institute

Incidentdiscovered Nov 20, 2024

Stated responseImmediately launched an investigation in consultation with legal counsel and cybersecurity experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov