HackingPIIPHIIdentity (basic)Health (basic)LowContained

Coastal Carolina Health Care, PA

bd_1edc9fedb96f0c35 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 28, 2025

Filed

Mar 23, 2026

To disclose

—

Affected

Not disclosed

Linked

4 filings

Confidence

65%

Full breach record for Coastal Carolina Health Care, PA →2 incidents on file

Coastal Carolina Health Care, PA notified Nebraska AG of a data breach affecting patient PII and PHI. Unauthorized access occurred March 21-27, 2025; discovered March 28, 2025. Notification sent March 23, 2026. FBI notified. Services offered include credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 7 days

Mar 21, 2025

Begins

Mar 28, 2025

Discovered

Mar 23, 2026

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

New Hampshire State AGbd_067b0d28c4df5e8b2026-03-24 · +1dVerified
Massachusetts State AGbd_2b577f4dc04bcee22026-03-24 · +1dCandidate
HHS OCRbd_5f289ed36ffb59982026-03-24 · +1dVerified by operator

Name: Coastal Carolina Health Care, PA
norm: coastal carolina health care

Name: Coastal Carolina Health Care, PA
norm: coastal carolina health care

Discovered: Mar 28, 2025
Breach occurred: Mar 21, 2025 – Mar 27, 2025
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 23, 2026
Affected individuals: Not disclosed
Data types: PIIPHIIdentity (basic)Health (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified the Federal Bureau of Investigation
Initial access: exploit_public_facing

During the incident: Engaged a leading, independent cybersecurity firm to investigate
Engaged a third-party vendor to conduct a comprehensive review of the affected data
Notified the Federal Bureau of Investigation
Offered complimentary credit monitoring and identity theft protection services
Changes made: Implemented additional security features to reduce the risk of a similar incident
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Nebraska State AGMar 23 · first · this page

New Hampshire State AG+1d

Massachusetts State AG+1d

HHS OCR+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/0b480340-8b8b-4500-aecc-1d584a2c8fa4.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 23, 2026
Raw hash: e536290e53e5bf3c86e19b9ece3ec0f7f29b633ba2a769f788177982aa96d554

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityCoastal Carolina Health Care, PA

Victim entityCoastal Carolina Health Care, PA

Incidentdiscovered Mar 28, 2025

Stated responseEngaged a leading, independent cybersecurity firm to investigate

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov