Social EngineeringHealthcareHealthcarePhishingStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Amoskeag Health

bd_256baa1b134a77ab · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 25, 2023

Filed

Jan 16, 2024

To disclose

16 weeks

Affected

27state residents only

Confidence

66%

Full breach record for Amoskeag Health →

Amoskeag Health notified NH AG of a breach affecting 27 residents. Unauthorized access to employee email accounts occurred Sept 19-25, 2023, discovered Sept 25, 2023. Access likely via phishing. PII and government IDs exposed. Notices sent Jan 11, 2024. HHS notified. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 6 days

discovery → filing · 16 weeks / 113 days

Sep 19, 2023

Begins

Sep 25, 2023

Discovered

Jan 16, 2024

Filed

vs. sector median

+4 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed27 affectedView incident

Name: Amoskeag Health
norm: amoskeag health
Domain: amoskeaghealth.org

Name: Amoskeag Health
norm: amoskeag health
Domain: amoskeaghealth.org
Industry: Healthcarellm

Discovered: Sep 25, 2023
Breach occurred: Sep 19, 2023 – Sep 25, 2023
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 11, 2024
Affected individuals: 27state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified the U.S. Department of Health and Human Services
Initial access: phishing_link

During the incident: Conducted an investigation
Reviewed its policies and procedures related to data protection
Changed account passwords
Provided notice to potentially impacted individuals
Notified the U.S. Department of Health and Human Services
Offered complimentary credit monitoring and identity protection services
Changes made: Reviewed policies and procedures related to data protection
Changed account passwords
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(113 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/amoskeag-health-20240116.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 16, 2024
Raw hash: fcd31ad491ccd47afa833075d3316b8c7bdd2ea929911dfcb90ca22b34212e96

Reporting entityAmoskeag Health

Victim entityAmoskeag Health

Incidentdiscovered Sep 25, 2023

Stated responseConducted an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov