HackingHealthcareHealthcareStolen CredentialsCapture App DataData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPIIPHILowContained
COMMUNITY HEALTH NETWORK, INC.
bd_1b20517a693bcd49 · schema v1 · pii pii-v1
Full breach record for COMMUNITY HEALTH NETWORK, INC. →Community Health Network, Inc. experienced unauthorized access to one employee email account Feb 25-26, 2025, discovered July 15, 2025. PHI affected: names, DOB, medical info, health insurance info. ~13,939 Indiana residents impacted; 2 Maine residents. HHS OCR notified under HIPAA. Consumer notifications began Sept 12, 2025.
Maine clockDiscovered Jul 15, 2025 → Filed with AG Sep 14, 202561d ⏱ ME AG >30d9 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_793eb2693d6f5c16Maine State AGfiled 2025-09-14Verified
- bd_8e7d5e4eafd827a1Indiana State AGfiled 2025-09-12(2d gap)Candidate
- bd_741a818ff7d888e6New Hampshire State AGfiled 2025-09-22(8d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/b9e152da-5287-44a0-886c-3d2b64a6b9c9.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 14, 2025
- Raw hash
- 3a7283368f683334d3539d973c747e43d396a47841a1014aa31d3edc81689ffb
Reporting entity
- Name
- COMMUNITY HEALTH NETWORK, INC.norm: community health network
- Industry
- Healthcare
Victim entity
- Name
- COMMUNITY HEALTH NETWORK, INC.norm: community health network
- Industry
- Healthcare
- Industry
- Healthcarellm
Incident
- Discovered
- Jul 15, 2025
- Materiality determined
- May 8, 2025
- Notification sent
- Sep 12, 2025
- Affected individuals
- 2
- Data types
- PIIPHI
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1114 Email Collection
- Threat actor
- External
- Regulator citations
- Notified HHS OCR pursuant to HIPAA Breach Notification Rule 45 CFR §§ 164.400-414
Compliance
- Time to disclose
- 9 weeks(61 days from discovery to filing)
- Compliance flags
- ME AG >30d · 61d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Jul 15, 2025→ Filed with AG: Sep 14, 202561d 30 days (soft) ME AG >30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.