MisuseHealthcarePIILowContained

Littleton Regional Hospital

bd_260916a581e8d126 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 25, 2009

Filed

Apr 13, 2009

To disclose

19 days

Affected

Not disclosed

Confidence

65%

Littleton Regional Hospital notified the NH Attorney General on April 13, 2009, of a security breach involving a patient's computerized personal information. A former employee accessed the data on three dates in late 2008/early 2009 for non-business purposes. The hospital detected the breach via a patient complaint on March 25, 2009, and notified the patient on March 27, 2009.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 163 days

discovery → filing · 19 days

Oct 13, 2008

Begins

Mar 25, 2009

Discovered

Apr 13, 2009

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Littleton Regional Hospital
norm: littleton regional hospital

Name: Littleton Regional Hospital
norm: littleton regional hospital

Discovered: Mar 25, 2009
Breach occurred: Oct 13, 2008 – Jan 5, 2009
Undetected for: 163 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 27, 2009
Affected individuals: Not disclosed
Data types: PII
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: Notified the New Hampshire Office of the Attorney General
Initial access: insider_action

During the incident: Initiated an investigatory audit of our computer system
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 days(19 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/littleton-hospital-20090413.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 13, 2009
Raw hash: 007e58c34b66370efcdef65834e1d3593699b28a869dabb7fdcc7b0098c8a1ed

Reporting entityLittleton Regional Hospital

Victim entityLittleton Regional Hospital

Incidentdiscovered Mar 25, 2009

Stated responseInitiated an investigatory audit of our computer system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov