HackingHealthcareHealthcareCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsMedium

Mount Desert Island Hospital

bd_22158dc4a26fa3ca · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 21, 2023

Filed

Sep 19, 2023

To disclose

13 weeks

Affected · nationwide

32,66126,046 in this filing

Linked

11 filings

Confidence

50%

Full breach record for Mount Desert Island Hospital →

Mount Desert Island Hospital, Inc. experienced an external system breach (hacking) on April 28, 2023, which was discovered on June 21, 2023. The breach affected 26,046 Maine residents, compromising their names and financial account information. The hospital notified the affected individuals and offered 24 months of credit monitoring and identity protection services through IDX.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jun 21, 2023 → Filed with AG Sep 19, 202390d ⏱ ME AG >30d13 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 54 days

discovery → filing · 13 weeks / 90 days

Apr 28, 2023

Begins

Jun 21, 2023

Discovered

Sep 19, 2023

Filed

vs. sector median

on median

This filing is one of 11 about the same incident.View merged incident

A leak claim by dispossessor about this victim predates this filing by 108 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitesnatchbd_06a87387a5341b482023-06-05 · +106dVerified by operator
Leak Sitedispossessorbd_b8dca3cb5dc60ff42023-06-03 · +108dVerified by operator

Regulatory filings (8) · sorted by filing gap

New Hampshire State AGbd_113f749ab88f2f6b2023-09-19Verified
Maine State AGbd_437493e24886ba992023-07-17 · +64dVerified
New Hampshire State AGbd_044b7cb6e8c5de742023-07-14 · +67dVerified
Massachusetts State AGbd_078a57c00ca2db1d2023-07-14 · +67dVerified

Show 4 more filings ↓up to 106d gap

Montana State AGbd_d67d09f2ab8c5b202023-07-14 · +67dVerified
Vermont State AGbd_529604a4efb3f8f52023-06-30 · +81dVerified
HHS OCRbd_5f803381a2b19c3e2023-06-30 · +81dVerified by operator
Indiana State AGbd_26f8fb34f618424e2023-06-05 · +106dCandidate

Name: Mount Desert Island Hospital
norm: mount desert island hospital
Domain: mdihospital.org

Name: Mount Desert Island Hospital
norm: mount desert island hospital
Domain: mdihospital.org
Industry: Healthcarellm

Discovered: Jun 21, 2023
Breach occurred: Apr 28, 2023
Undetected for: 54 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 19, 2023
Affected individuals: 32,661state + nationwide
Data types: Identity (basic)Financial accountFinancial credentials
Data elements: Financial account number
Attack vector: Unauthorized Access
Threat actor: External

Changes made: Offered 24 months of credit monitoring and identity protection services provided by IDX.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(90 days from discovery to filing)
Compliance flags: ME AG >30d · 90dLeak >90dME CRA notice due
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jun 21, 2023
→ Filed with AG: Sep 19, 2023
90d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jun 21, 2023 → Filed with AG: Sep 19, 2023	90d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 6 states

View merged incident ↗

Indiana State AGJun 5 · first

Vermont State AG+25d

HHS OCR+25d

New Hampshire State AG+39d

Massachusetts State AG+39d

Montana State AG+39d

Maine State AG+42d

New Hampshire State AG+106d

Maine State AG+106d · this page

Pattern: first filing Jun 5 (IN), last Sep 19 (ME) — a 106-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/4edaf9ec-0c98-4ae2-8382-6b44675f62ab.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 19, 2023
Raw hash: 572f4cbdd84daf0dea52e8a70d7518f6db2d777324fab1906585e5b96f80e385

Linked disclosures

Ransomware claims (2)

Regulatory filings (8) · sorted by filing gap

Reporting entityMount Desert Island Hospital

Victim entityMount Desert Island Hospital

Incidentdiscovered Jun 21, 2023

Stated responseOffered 24 months of credit monitoring and identity protection services provided by IDX.

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov