HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountHighContained

Western Montana Mental Health Center

bd_154ae35704eb4331 · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 15, 2024

Filed

Jul 18, 2025

To disclose

44 weeks

Affected · nationwide

86,7586 in this filing

Linked

8 filings

Confidence

65%

Full breach record for Western Montana Mental Health Center →2 incidents on file

Western Montana Mental Health Center reported an external system breach occurring on September 11, 2024, discovered on September 15, 2024. The incident compromised personal and protected health information (including SSNs, driver's licenses, and medical data) for approximately 86,758 individuals, including 6 Maine residents. Notices were sent on July 17, 2025, offering 12 months of identity protection services.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Sep 15, 2024 → Filed with AG Jul 18, 2025306d ✗ ME AG >90d44 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 4 days

discovery → filing · 44 weeks / 306 days

Sep 11, 2024

Begins

Sep 15, 2024

Discovered

Jul 18, 2025

Filed

vs. sector median

+33 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Massachusetts State AGbd_67a72bd7f639a7b72025-07-18Verified
New Hampshire State AGbd_c165bdbada433eae2025-07-18Verified
Montana State AGbd_302a8478f032d5e02025-07-17 · +1dCandidate
Nebraska State AGbd_3e621ed6b0cebeef2025-07-17 · +1dVerified

Show 3 more filings ↓up to 1d gap

Vermont State AGbd_48f24baf2ecae00e2025-07-17 · +1dVerified
Montana State AGbd_5dd79b9c22b6bdc72025-07-17 · +1dVerified
Indiana State AGbd_6ec13e1ebb9b4d082025-07-17 · +1dVerified

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Name: Western Montana Mental Health Center
norm: western montana mental health center
Industry: Healthcarellm

Discovered: Sep 15, 2024
Breach occurred: Sep 11, 2024 – Sep 15, 2024
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 17, 2025
Affected individuals: 86,758state + nationwide
Data types: Identity (basic)Government IDHealth (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Maine Attorney GeneralNotified the Federal Bureau of Investigation
Initial access: exploit_public_facing

During the incident: Initiated an investigation of the matter with the assistance of independent cybersecurity experts
Engaged a third-party data review team to conduct a comprehensive review of those files
Retained cybersecurity experts and launched a forensics investigation
Notified the Federal Bureau of Investigation and will cooperate with any resulting investigation
Offered 12 months of complimentary identity protection services through IDX
Changes made: Implemented additional security measures to further harden its digital environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 44 weeks(306 days from discovery to filing)
Compliance flags: ME AG >90d · 306dME resident >180d · 305d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Sep 15, 2024
→ Filed with AG: Jul 18, 2025
306d 90 days ME AG >90d
Maine
Discovered: Sep 15, 2024
→ Notified: Jul 17, 2025
305d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Sep 15, 2024 → Filed with AG: Jul 18, 2025	306d	90 days	ME AG >90d
Maine	Discovered: Sep 15, 2024 → Notified: Jul 17, 2025	305d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

Montana State AGJul 17 · first

Nebraska State AGJul 17 · first

Vermont State AGJul 17 · first

Montana State AGJul 17 · first

Indiana State AGJul 17 · first

Massachusetts State AG+1d

New Hampshire State AG+1d

Maine State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/eddb74c4-b969-4fd8-8e71-4b9f003095bd.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 18, 2025
Raw hash: c54fddf8e0cc83833721dbdbf4417decb1f71e4ac25b7ee7afc0659bbe8b7135

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityConstangy, Brooks, Smith & Prophete, LLP

Victim entityWestern Montana Mental Health Center

Incidentdiscovered Sep 15, 2024

Stated responseInitiated an investigation of the matter with the assistance of independent cybersecurity experts

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov