DisclosureLens
HackingHealthcareHealthcareCustomer Data InvolvedIdentity (basic)Government IDCriticalContained

Goodman Campbell Brain and Spine

bd_19550062fc4d87f1 · schema v1 · pii pii-v1

Severity

Critical

Discovered

May 20, 2022

Filed

Jul 22, 2022

To disclose

9 weeks

Affected · nationwide

362,83322 in this filing

Linked

5 filings

Confidence

50%
Full breach record for Goodman Campbell Brain and Spine →

Goodman Campbell Brain and Spine, a healthcare provider, experienced an external system breach (hacking) on May 17, 2022, discovered on May 20, 2022. The breach affected 362,833 individuals in total, including 22 Maine residents. The compromised information includes names and Social Security Numbers. Affected individuals were notified on July 19, 2022, and offered one year of single-bureau credit monitoring through TransUnion.

Maine clockDiscovered May 20, 2022 → Filed with AG Jul 22, 202263d ⏱ ME AG >30d9 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 3 days
discovery → filing · 9 weeks / 63 days

May 17, 2022

Begins

May 20, 2022

Discovered

Jul 22, 2022

Filed

vs. sector median

3 wks faster

This filing is one of 5 about the same incident.View merged incident
A leak claim by hive about this victim predates this filing by 43 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Filing propagation · 4 filings · 4 states

View merged incident ↗
Illinois State AGJan 1 · first
HHS OCR+199d
Maine State AG+202d · this page
Massachusetts State AG+206d

Pattern: first filing Jan 1 (IL), last Jul 26 (MA) — a 206-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.