HackingHealthcareProfessional ServicesHealthcareSupply Chain (3P Vendor)Customer Data InvolvedDelayed DiscoveryPIIIdentity (basic)Government IDFinancial accountHealth (basic)PHIMediumContained

NewGen Administrative Services, LLC

bd_14ff22bcc679e741 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 14, 2023

Filed

Feb 23, 2024

To disclose

23 weeks

Affected

6state residents only

Linked

4 filings

Confidence

66%

Full breach record for NewGen Administrative Services, LLC →

NewGen Administrative Services, LLC notified the NH Attorney General of a security incident involving a third-party managed services provider. On September 13, 2023, the provider detected potential unauthorized access to servers hosting NewGen's data. NewGen was notified on September 14, 2023. The incident potentially affected 6 New Hampshire residents. Data types potentially exposed include PII, PHI, and financial information. NewGen engaged in investigation, notified regulators and credit bureaus, and offered credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 23 weeks / 162 days

Sep 13, 2023

Begins

Sep 14, 2023

Discovered

Feb 23, 2024

Filed

vs. sector median

+11 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_2e4ec69fe50511d92024-02-23Candidate
Indiana State AGbd_b3ca00b1300996c12024-02-23Verified
Massachusetts State AGbd_2010c5929f5b211e2024-02-24 · +1dVerified

Name: NewGen Administrative Services, LLC
norm: newgen administrative

Name: NewGen Administrative Services, LLC
norm: newgen administrative
Industry: HealthcarellmProfessional Servicesllm

Discovered: Sep 14, 2023
Breach occurred: Sep 13, 2023
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Feb 23, 2024
Affected individuals: 6state-resident count only
Data types: PIIIdentity (basic)Government IDFinancial accountHealth (basic)PHI
Attack vector: Third-Party / Supply Chain
Threat actor: External
Regulator citations: Notified Office of the New Hampshire Attorney GeneralNotified U.S. Department of Health and Human Services
Third party: via managed services provider

During the incident: Investigated and responded to the incident
Assessed the security of NewGen systems
Identified potentially affected individuals
Provided notice to all data owners whose data may have resided on the impacted servers
Provided notice to impacted individuals on behalf of data owners
Provided written notice to relevant state and federal regulators
Provided written notice to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Notified the U.S. Department of Health and Human Services
Notified prominent media pursuant to HIPAA
Changes made: Evaluating the safeguards, policies and procedures it has in place for its vendors
Providing access to credit monitoring services through Transunion at no cost
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Advising individuals to report any suspected incidents of identity theft or fraud to their credit card company and/or bank
Providing individuals with information on how to place a fraud alert and security freeze on one’s credit file
Providing contact details for the national consumer reporting agencies
Providing information on how to obtain a free credit report
Reminding individuals to remain vigilant for incidents of fraud and identity theft by reviewing account statements and monitoring free credit reports
Encouraging individuals to contact the Federal Trade Commission, their state Attorney General, and law enforcement to report attempted or actual identity theft and fraud
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(162 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGFeb 23 · first

Indiana State AGFeb 23 · first

New Hampshire State AGFeb 23 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/newgen-administrative-services-20240223.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 23, 2024
Raw hash: 70fbefc4578daba2dc3ceefe5582d6c90d538f820218bfe9b7f2dde3b1be721e

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityNewGen Administrative Services, LLC

Victim entityNewGen Administrative Services, LLC

Incidentdiscovered Sep 14, 2023

Stated responseInvestigated and responded to the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov