HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedPIIPHIIdentity (basic)Government IDHealth (basic)MediumContained

Boys Town National Research Hospital

bd_241ec65a312f1ba9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 23, 2018

Filed

Jul 20, 2018

To disclose

8 weeks

Affected

1state residents only

Linked

4 filings

Confidence

66%

Full breach record for Boys Town National Research Hospital →2 incidents on file

Boys Town National Research Hospital notified the NH Attorney General of unauthorized access to an employee email account on May 23, 2018. The incident potentially affected one New Hampshire resident, exposing name and Social Security number (PII) and protected health information (PHI). The organization engaged forensic experts, reset passwords, implemented enhanced security measures, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 58 days

May 23, 2018

Begins

May 23, 2018

Discovered

Jul 20, 2018

Filed

vs. sector median

4 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_65eea69ab3090da02018-07-20Verified
HHS OCRbd_994d71fed75ec51f2018-07-20Verified
Massachusetts State AGbd_dd92386ef6091e312018-07-20Verified

Name: Boys Town National Research Hospital
norm: boys town national research hospital

Name: Boys Town National Research Hospital
norm: boys town national research hospital
Industry: Healthcarellm

Discovered: May 23, 2018
Breach occurred: May 23, 2018
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 13, 2018
Affected individuals: 1state-resident count only
Data types: PIIPHIIdentity (basic)Government IDHealth (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Providing notice to other state and federal regulatorsReported this incident to law enforcement

During the incident: Launched an investigation to determine what may have happened and what information may have been affected, working with computer forensics experts
Reset passwords for Boys Town email accounts
Implemented increased security measures for email account access
Conducted additional employee training
Reviewed their company policies and procedures relating to data security
Notified necessary regulatory and law enforcement bodies
Offering affected individuals complimentary access to 12 months of free credit monitoring and identity restoration services through AllClear ID
Providing potentially affected individuals with information on how to protect against identity theft and fraud
Changes made: Reset passwords for Boys Town email accounts
Implemented increased security measures for email account access
Conducted additional employee training
Reviewed their company policies and procedures relating to data security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(58 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGJul 20 · first

HHS OCRJul 20 · first

Massachusetts State AGJul 20 · first

New Hampshire State AGJul 20 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/boys-town-20180720.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 20, 2018
Raw hash: aedc0d9aee012765c50ded294581ddedaa0533ea4b956b2ee7afd6dceff6ca1e

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityBoys Town National Research Hospital

Victim entityBoys Town National Research Hospital

Incidentdiscovered May 23, 2018

Stated responseLaunched an investigation to determine what may have happened and what information may have been affected, working with computer forensics experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov