HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)PHIMediumContained

Aspire Rural Health System

bd_1d598752613e92d0 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 18, 2025

Filed

Aug 25, 2025

To disclose

5 weeks

Affected

3state residents only

Linked

10 filings

Confidence

66%

Full breach record for Aspire Rural Health System →2 incidents on file

Aspire Rural Health System notified the New Hampshire Attorney General that an unauthorized party accessed its internal network between November 4, 2024, and January 6, 2025. The breach affected 3 New Hampshire residents, exposing names, SSNs, and medical information. Aspire engaged outside cybersecurity professionals, concluded its investigation on July 18, 2025, and began notifying affected individuals on August 20, 2025, offering credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d5 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 256 days

discovery → filing · 5 weeks / 38 days

Nov 4, 2024

Begins

Jul 18, 2025

Discovered

Aug 25, 2025

Filed

vs. sector median

7 wks faster

This filing is one of 10 about the same incident.View merged incident

A leak claim by bianlian about this victim predates this filing by 231 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitebianlianbd_9f371d439a18287e2025-02-13 · +192dVerified by operator
Leak Sitebianlianbd_3f3ca4b9593482dd2025-01-06 · +231dVerified by operator

Regulatory filings (7) · sorted by filing gap

Texas State AGbd_2f1330d50f85d7532025-08-22 · +3dVerified by operator
Maine State AGbd_f022d87963b7c8612025-08-21 · +4dVerified
Massachusetts State AGbd_f207f1048a96a30c2025-08-21 · +4dVerified by operator
Indiana State AGbd_564811f065d22d832025-08-20 · +5dVerified by operator

Show 3 more filings ↓up to 5d gap

HHS OCRbd_84cabab9d554b97c2025-08-20 · +5dVerified by operator
Nebraska State AGbd_8e17f1db35d4846c2025-08-20 · +5dVerified
Vermont State AGbd_b55b7c1a2e8908402025-08-20 · +5dVerified by operator

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: Aspire Rural Health System
norm: aspire rural health system
Domain: aspirerhs.org
Industry: Healthcarellm

Discovered: Jul 18, 2025
Breach occurred: Nov 4, 2024 – Jan 6, 2025
Undetected for: 256 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 20, 2025
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security numberMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified the Office of the New Hampshire Attorney General Consumer Protection Bureau
Initial access: exploit_public_facing

During the incident: Engaged leading outside cybersecurity professionals to secure the environment and to identify the scope of what personal information, if any, was involved
Offered the potentially affected residents whose Social Security number was potentially impacted with complimentary credit-monitoring services
Provided notification of this incident commencing on or about August 20, 2025
Changes made: Continually evaluates and modifies its practices to enhance the security and privacy of the personal information it maintains
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(38 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Indiana State AGAug 20 · first

HHS OCRAug 20 · first

Nebraska State AGAug 20 · first

Vermont State AGAug 20 · first

Maine State AG+1d

Massachusetts State AG+1d

Texas State AG+2d

New Hampshire State AG+5d · this page

Pattern: first filing Aug 20 (IN), last Aug 25 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/aspire-rural-health-system-20250825.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 25, 2025
Raw hash: 698d753d8e7bdb8c0ebf4d437aef7723e4303dcf132099166ff7789f8934bf79

Linked disclosures

Ransomware claims (2)

Regulatory filings (7) · sorted by filing gap

Reporting entityMCDONALD HOPKINS LLC

Victim entityAspire Rural Health System

Incidentdiscovered Jul 18, 2025

Stated responseEngaged leading outside cybersecurity professionals to secure the environment and to identify the scope of what personal information, if any, was involved

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov