HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

Medical Associates of Brevard, LLC

bd_1a02292581ce4e21 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 7, 2025

Filed

Sep 9, 2025

To disclose

9 weeks

Affected

100state residents only

Linked

5 filings

Confidence

68%

Full breach record for Medical Associates of Brevard, LLC →2 incidents on file

Medical Associates of Brevard, LLC notified the New Hampshire Attorney General of a criminal cyberattack affecting 100 NH residents. Discovered July 7, 2025, the incident exposed PII including names, SSNs, driver's licenses, and PHI. MAB secured systems, replaced firewalls, and provided 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d9 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 9 weeks / 64 days

Jul 7, 2025

Discovered

Sep 9, 2025

Filed

vs. sector median

3 wks faster

This filing is one of 5 about the same incident.View merged incident

A leak claim by bianlian about this victim predates this filing by 235 days.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_00621575f72b9ba62025-09-05 · +4dVerified
Montana State AGbd_931740a61e3ad4362025-09-05 · +4dVerified by operator
HHS OCRbd_e893a194966d9bcd2025-09-05 · +4dVerified by operator
Indiana State AGbd_edb62dd27b0c7f3f2025-09-05 · +4dVerified by operator

Name: Jackson Lewis
norm: jackson lewis
Domain: jacksonlewis.com

Name: Medical Associates of Brevard, LLC
norm: medical of brevard
Domain: mabmd.com
Industry: Healthcarellm

Discovered: Jul 7, 2025
Materiality determined: —
Notification sent: —
Affected individuals: 100state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: exploit_public_facing

During the incident: Took immediate steps to secure its systems and investigate the nature and scope of the Incident
Worked diligently to identify any PII that may have been subject to unauthorized access or acquisition
Provided notice to the affected New Hampshire residents
Arranged for the individuals to enroll in free credit monitoring and related services for at least 12 months
Changes made: Replaced its firewall and all of the systems impacted by the incident
Hardened its existing security monitoring software
Strengthened its email security system
Thoroughly reviewed and upgraded its data security policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(64 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maine State AGSep 5 · first

Montana State AGSep 5 · first

HHS OCRSep 5 · first

Indiana State AGSep 5 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/medical-associates-brevard-20250909.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 9, 2025
Raw hash: 2d96e8adbf6644cf801e2bc7df579aaab7b84feaed150db4e56a6238a5b7b75f

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityJackson Lewis

Victim entityMedical Associates of Brevard, LLC

Incidentdiscovered Jul 7, 2025

Stated responseTook immediate steps to secure its systems and investigate the nature and scope of the Incident

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov