MalwareHealthcareHealthcareRansomwareStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedDelayed DiscoveryPIIIdentity (basic)PHIHealth (basic)HighContained

Florida Community Health Centers

bd_124b917ef0b00e64 · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 13, 2023

Filed

Jul 1, 2024

To disclose

13 months

Affected · nationwide

296,63563 in this filing

Linked

5 filings

Confidence

66%

Full breach record for Florida Community Health Centers →

Florida Community Health Centers (FCHC) disclosed a ransomware incident discovered on June 13, 2023, affecting 296,635 individuals, including 63 Maine residents. The attack involved unauthorized access via valid credentials, leading to data encryption and potential exposure of patient health information and PII. FCHC engaged forensic investigators, secured its network, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jun 13, 2023 → Filed with AG Jul 1, 2024384d ✗ ME AG >90d13 months discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 13 months / 384 days

Jun 13, 2023

Begins

Jun 13, 2023

Discovered

Jul 1, 2024

Filed

vs. sector median

+42 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_0e4d1a601747b1e32024-07-01Verified
Massachusetts State AGbd_28e96f436c35f4602024-07-01Verified
Montana State AGbd_3d1f8da21ff4c2f82024-07-01Verified
New Hampshire State AGbd_97ee01f6efeaee742024-07-05 · +4dVerified

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: Florida Community Health Centers
norm: florida community health centers
Industry: Healthcarellm

Discovered: Jun 13, 2023
Breach occurred: Jun 13, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 1, 2024
Affected individuals: 296,635state + nationwide
Data types: PIIIdentity (basic)PHIHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Maine Attorney General
Initial access: valid_credentials

During the incident: Engaged cybersecurity experts to conduct a thorough investigation
Shut down its network
Implemented necessary patches
Engaged a specialized incident response vendor to secure its network and conduct a forensic investigation
Engaged a third-party data mining vendor to further assist with reviewing the sensitive personal information
Changes made: Strengthening password requirements
Implementing new technical and physical safeguards to secure the data within its possession
Providing additional cybersecurity training for its employees
Providing twelve (12) months of complimentary credit monitoring and identity theft restoration services through Cyberscout
Provided guidance on how to better protect against identity theft and fraud
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 months(384 days from discovery to filing)
Compliance flags: ME AG >90d · 384dME resident >180d · 384d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jun 13, 2023
→ Filed with AG: Jul 1, 2024
384d 90 days ME AG >90d
Maine
Discovered: Jun 13, 2023
→ Notified: Jul 1, 2024
384d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jun 13, 2023 → Filed with AG: Jul 1, 2024	384d	90 days	ME AG >90d
Maine	Discovered: Jun 13, 2023 → Notified: Jul 1, 2024	384d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGJul 1 · first

Massachusetts State AGJul 1 · first

Montana State AGJul 1 · first

Maine State AGJul 1 · first · this page

New Hampshire State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/df1d9ed8-efbd-4c51-87e0-d797c7ce77f5.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 1, 2024
Raw hash: 0a95d0c65074510f79ad383df1e6f2b9b8dd096704060cdf4ff6d42140c00666

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityFlorida Community Health Centers

Incidentdiscovered Jun 13, 2023

Stated responseEngaged cybersecurity experts to conduct a thorough investigation

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov