HackingHealthcareIdentity (basic)Government IDHealth (basic)MediumActive

Mount Desert Island Hospital

bd_113f749ab88f2f6b · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 4, 2023

Filed

Sep 19, 2023

To disclose

20 weeks

Affected

Not disclosed

Linked

11 filings

Confidence

64%

Full breach record for Mount Desert Island Hospital →

Mount Desert Island Hospital, Inc. notified the New Hampshire Attorney General of a network security incident occurring between April 28 and May 7, 2023. The hospital became aware of the unauthorized access on May 4, 2023. The breach potentially impacted current and former employees, dependents, and beneficiaries, as well as patients, exposing names combined with sensitive identifiers. The investigation is ongoing, and the hospital has engaged third-party specialists, notified law enforcement, and is offering credit monitoring services to affected individuals.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d20 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 6 days

discovery → filing · 20 weeks / 138 days

Apr 28, 2023

Begins

May 4, 2023

Discovered

Sep 19, 2023

Filed

This filing is one of 11 about the same incident.View merged incident

A leak claim by dispossessor about this victim predates this filing by 108 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitesnatchbd_06a87387a5341b482023-06-05 · +106dVerified by operator
Leak Sitedispossessorbd_b8dca3cb5dc60ff42023-06-03 · +108dVerified by operator

Regulatory filings (8) · sorted by filing gap

Maine State AGbd_22158dc4a26fa3ca2023-09-19Verified
Maine State AGbd_437493e24886ba992023-07-17 · +64dVerified
New Hampshire State AGbd_044b7cb6e8c5de742023-07-14 · +67dVerified
Massachusetts State AGbd_078a57c00ca2db1d2023-07-14 · +67dVerified

Show 4 more filings ↓up to 106d gap

Montana State AGbd_d67d09f2ab8c5b202023-07-14 · +67dVerified
Vermont State AGbd_529604a4efb3f8f52023-06-30 · +81dVerified
HHS OCRbd_5f803381a2b19c3e2023-06-30 · +81dVerified by operator
Indiana State AGbd_26f8fb34f618424e2023-06-05 · +106dCandidate

Name: Mount Desert Island Hospital
norm: mount desert island hospital
Domain: mdihospital.org

Name: Mount Desert Island Hospital
norm: mount desert island hospital
Domain: mdihospital.org

Discovered: May 4, 2023
Breach occurred: Apr 28, 2023 – May 7, 2023
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 19, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General's Consumer Protection Bureau
Initial access: exploit_public_facing

During the incident: Began an investigation, which included working with third-party specialists
Notified law enforcement
Conducted a thorough review of the impacted portions of its network
Worked with third-party specialists to investigate, re-secure our network, and implement additional security precautions
Offering you access to 12/24 months of complimentary credit monitoring and identity protection services
Changes made: Re-secure our network
Implement additional security precautions
Reviewing our policies and procedures related to data protection
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 weeks(138 days from discovery to filing)
Compliance flags: Leak >90d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 6 states

View merged incident ↗

Indiana State AGJun 5 · first

Vermont State AG+25d

HHS OCR+25d

New Hampshire State AG+39d

Massachusetts State AG+39d

Montana State AG+39d

Maine State AG+42d

Maine State AG+106d

New Hampshire State AG+106d · this page

Pattern: first filing Jun 5 (IN), last Sep 19 (NH) — a 106-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/mount-desert-island-hospital-20230919.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 19, 2023
Raw hash: 146f44a3dbe396a0bc20c5f798ba1eb4e4c131bace581bfdc8aacc6e2043d34b

Linked disclosures

Ransomware claims (2)

Regulatory filings (8) · sorted by filing gap

Reporting entityMount Desert Island Hospital

Victim entityMount Desert Island Hospital

Incidentdiscovered May 4, 2023

Stated responseBegan an investigation, which included working with third-party specialists

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov