HackingStolen CredentialsCapture Stored DataSupply Chain (3P Vendor)Business Associate (HIPAA)Data ExfiltratedCustomer Data InvolvedDownstream VictimsIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICFINANCIAL_ACCOUNTMediumContained
Yale New Haven Health Services Corporation
bd_14bf0242d5905375 · schema v1 · pii pii-v1
Full breach record for Yale New Haven Health Services Corporation →Supplemental notice regarding a cybersecurity incident at vendor Tobin, Carberry, O'Malley, Riley & Selinger, P.C. (TCORS), a business associate of Yale New Haven Health (YNHH). Unauthorized access occurred Nov 10-30, 2023. TCORS notified YNHH on Dec 4, 2023. YNHH notified 5 impacted individuals on July 19, 2024. Data included PII, SSN, PHI, and bank info. Third-party forensics engaged. Identity theft protection offered.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_416c7062bea04db4Vermont State AGfiled 2024-08-09(10d gap)Candidate
- bd_f9c3c7420bcc2141New Hampshire State AGfiled 2024-12-26(129d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/tobin-carberry-omalley-riley-selinger-yale-new-haven-health-20240819.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 19, 2024
- Raw hash
- f65e3f32202ca2ebda5feaea830ffd4987729bf5992c48a665aa259b65de31d1
Reporting entity
- Name
- Tobin, Carberry, O'Malley, Riley & Selinger, P.C.norm: tobin carberry o malley riley selinger
Victim entity
- Name
- Yale New Haven Health Services Corporationnorm: yale new haven health
Incident
- Discovered
- Dec 4, 2023
- Materiality determined
- —
- Notification sent
- Jul 19, 2024
- Affected individuals
- 5
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1119 Automated Collection
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified New Hampshire Department of Justice
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 37 weeks(259 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.