HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

Community Care Alliance

bd_11480fae58d4f162 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 6, 2024

Filed

Mar 7, 2025

To disclose

35 weeks

Affected

14state residents only

Linked

12 filings

Confidence

66%

Full breach record for Community Care Alliance →

Community Care Alliance, a healthcare provider, notified Maryland AG of a data breach occurring July 1-5, 2024. Unauthorized actors accessed systems containing PII (names, SSNs, DLs) and PHI (diagnoses, lab results, medications) for 14 Maryland residents. Notifications were sent March 7, 2025, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maryland clock✗ MD AG >90d35 weeks discovery → filing

Incident timeline

undetected · 5 days

discovery → filing · 35 weeks / 244 days

Jul 1, 2024

Begins

Jul 6, 2024

Discovered

Mar 7, 2025

Filed

vs. sector median

+22 wks slower

This filing is one of 12 about the same incident.View merged incident

A leak claim by rhysida about this victim predates this filing by 244 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siterhysidabd_95172056dcf4342a2024-07-26 · +223dVerified
Leak Siterhysidabd_656d112c466333962024-07-06 · +244dVerified by operator

Regulatory filings (8) · sorted by filing gap

Maine State AGbd_5fc914b4b0fa00fb2025-03-07Verified
Vermont State AGbd_7ab8069417339df32025-03-07Verified by operator
Indiana State AGbd_7df035502e606dad2025-03-07Verified by operator
Montana State AGbd_eddde174f903fd062025-03-07Verified by operator

Show 4 more filings ↓up to 6d gap

Massachusetts State AGbd_b15ef12290999cea2025-03-08 · +1dVerified by operator
Rhode Island State AGbd_473893005e2e34c12025-03-10 · +3dVerified
HHS OCRbd_6a779c94181037392025-03-01 · +6dVerified
HHS OCRbd_f2e045bf08be0a602025-03-01 · +6dVerified

Showing first 10 of 11 linked disclosures.

Name: Jason Goodwin, Esq.
norm: jason goodwin esq

Name: Community Care Alliance
norm: community care alliance
Domain: communitycareri.org
Industry: Healthcarellm

Discovered: Jul 6, 2024
Breach occurred: Jul 1, 2024 – Jul 5, 2024
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 7, 2025
Affected individuals: 14state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Engaged third-party forensic specialists to assist in a thorough investigation
Notified law enforcement
Provided direct notice to the potentially impacted individuals via U.S. mail
Offered complimentary credit monitoring and identity protection services
Changes made: Implemented additional technical measures
Implemented additional technical safeguards to further enhance the security of data
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 35 weeks(244 days from discovery to filing)
Compliance flags: MD AG >90dLeak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 7 states

View merged incident ↗

HHS OCRMar 1 · first

Maryland State AG+6d · this page

Massachusetts State AG+7d

Rhode Island State AG+9d

Pattern: first filing Mar 1 (RI), last Mar 10 (RI) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 11 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376520.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 7, 2025
Raw hash: 73655b14d7000c436ffbcfd4aefd8da75d606b2e928257bf8a4769a3263273f4

Linked disclosures

Ransomware claims (2)

Regulatory filings (8) · sorted by filing gap

Reporting entityJason Goodwin, Esq.

Victim entityCommunity Care Alliance

Incidentdiscovered Jul 6, 2024

Stated responseEngaged third-party forensic specialists to assist in a thorough investigation

ComplianceMD AG >90d

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov