MalwareHealthcareHealthcareRansomwareData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedRansom DemandedGovernment IDIdentity (basic)Health (basic)MediumContained

Allwell Behavioral Health Services

bd_1610d89e5dc2f00a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 5, 2022

Filed

May 23, 2022

To disclose

11 weeks

Affected

1state residents only

Linked

6 filings

Confidence

66%

Full breach record for Allwell Behavioral Health Services →

Allwell Behavioral Health Services (ABHS) notified the New Hampshire Attorney General of a ransomware incident discovered on March 5, 2022. An unknown third party gained access to ABHS servers, encrypted data, and potentially exfiltrated patient and employee information (including SSNs and PHI). Approximately 1 New Hampshire resident was affected. ABHS engaged forensic experts, notified the FBI and CISA, and sent notification letters offering credit monitoring and identity theft protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

discovery → filing · 11 weeks / 79 days

Mar 2, 2022

Begins

Mar 5, 2022

Discovered

May 23, 2022

Filed

vs. sector median

+2 wks slower

This filing is one of 6 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_6c239ce3cc969d622022-05-23Verified
Indiana State AGbd_785b12a92dcec05e2022-05-23Verified
Montana State AGbd_8a31afbb18f198e72022-05-23Verified
HHS OCRbd_b5f444a97d3bf5612022-05-23Verified

Show 1 more filing ↓up to 1d gap

Massachusetts State AGbd_d185f8dde0973d762022-05-24 · +1dVerified

Name: Lewis Brisbois Bisgaard & Smith, PLLC
norm: lewis brisbois bisgaard smith

Name: Allwell Behavioral Health Services
norm: allwell behavioral health
Domain: allwell.org
Industry: Healthcarellm

Discovered: Mar 5, 2022
Breach occurred: Mar 2, 2022
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 23, 2022
Affected individuals: 1state-resident count only
Data types: Government IDIdentity (basic)Health (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the FBI and CISANotified the U.S. Department of Health and Human Services Office for Civil Rights
Initial access: valid_credentials

During the incident: Notified the Federal Bureau of Investigation (FBI) and U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA)
Engaged cybersecurity experts to supplement its response efforts, including conducting a forensic investigation
Sent notification letters to affected New Hampshire residents via USPS First Class Mail
Offered complimentary identity protection services, including credit monitoring, dark web monitoring, $1 million identity fraud loss reimbursement policy, and fully-managed identity theft recovery services
Notified nationwide consumer reporting agencies of the incident
Changes made: Implemented additional security measures to further harden its digital environment
Upgraded information technology and computer systems to provide additional security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(79 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Maine State AGMay 23 · first

Indiana State AGMay 23 · first

Montana State AGMay 23 · first

HHS OCRMay 23 · first

New Hampshire State AGMay 23 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/allwell-behavioral-health-20220523.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 23, 2022
Raw hash: 625975e2c842b11dfcfe9dfe0d471aa84312fa6132c344acec4acc8a32399c13

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityLewis Brisbois Bisgaard & Smith, PLLC

Victim entityAllwell Behavioral Health Services

Incidentdiscovered Mar 5, 2022

Stated responseNotified the Federal Bureau of Investigation (FBI) and U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA)

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov