HackingHealthcareHealthcareCustomer Data InvolvedData ExfiltratedIdentity (basic)Government IDHealth (basic)Financial accountFinancial credentialsHighContained

Alpine Ear Nose & Throat

bd_273587203463b4c1 · schema v1 · pii pii-v1

Severity

High

Discovered

Nov 19, 2024

Filed

Jan 30, 2026

To disclose

15 months

Affected · nationwide

65,64810 in this filing

Linked

7 filings

Confidence

66%

Full breach record for Alpine Ear Nose & Throat →

Alpine Ear, Nose, & Throat, P.C. (AENT), a healthcare provider in Colorado, disclosed a cybersecurity incident discovered on November 19, 2024. An unauthorized actor gained access to systems, potentially exposing demographic, medical, insurance, and financial data (including SSNs and credit card numbers) for 65,648 individuals, including 10 Maine residents. AENT engaged forensic investigators, secured systems, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Nov 19, 2024 → Filed with AG Jan 30, 2026437d ✗ ME AG >90d15 months discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 15 months / 437 days

Nov 19, 2024

Begins

Nov 19, 2024

Discovered

Jan 30, 2026

Filed

vs. sector median

+51 wks slower

This filing is one of 7 about the same incident.View merged incident

A leak claim by bianlian about this victim predates this filing by 437 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitebianlianbd_cbbe2673519f7a142024-12-01 · +425dVerified
Leak Sitebianlianbd_aa6f35632c5bb0f82024-11-19 · +437dVerified by operator

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_1b1e0b50cd16d0cd2026-01-30Verified
New Hampshire State AGbd_a4f33ce1e416b9fd2026-01-30Verified
Massachusetts State AGbd_ca77674f1f4bab5f2026-01-30Verified
HHS OCRbd_513c3cd96acbfdd12025-01-17 · +378dVerified

Name: Wilson Elser Moskowitz Edelman & Dicker LLP
norm: wilson elser

Name: Alpine Ear Nose & Throat
norm: alpine ear nose throat
Domain: alpineent.com
Industry: Healthcarellm

Discovered: Nov 19, 2024
Breach occurred: Nov 19, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 30, 2026
Affected individuals: 65,648state + nationwide
Data types: Identity (basic)Government IDHealth (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1119 Automated Collection
Threat actor: External
Regulator citations: Notified Maine Attorney General
Initial access: exploit_public_facing

During the incident: Engaged a specialized third-party cybersecurity firm to conduct a forensic investigation
Worked with their Managed Services Provider (MSP) to secure their systems
Offered twelve (12) months of complimentary credit monitoring and identity theft restoration services through IDX
Provided guidance on how to better protect against identity theft and fraud
Changes made: Enhancing technical security measures and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 months(437 days from discovery to filing)
Compliance flags: ME AG >90d · 437dME resident >180d · 437dLeak >180d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Nov 19, 2024
→ Filed with AG: Jan 30, 2026
437d 90 days ME AG >90d
Maine
Discovered: Nov 19, 2024
→ Notified: Jan 30, 2026
437d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Nov 19, 2024 → Filed with AG: Jan 30, 2026	437d	90 days	ME AG >90d
Maine	Discovered: Nov 19, 2024 → Notified: Jan 30, 2026	437d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

HHS OCRJan 17 · first

Indiana State AG+378d

New Hampshire State AG+378d

Massachusetts State AG+378d

Maine State AG+378d · this page

Pattern: first filing Jan 17 (CO), last Jan 30 (ME) — a 378-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/20cb3fde-af2f-4f1f-a4fb-56e85d56f6aa.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 30, 2026
Raw hash: 5a235ce93374341e2319910dc37f7c82873db4ba368a5f4f77170bc67c018cd6

Linked disclosures

Ransomware claims (2)

Regulatory filings (4) · sorted by filing gap

Reporting entityWilson Elser Moskowitz Edelman & Dicker LLP

Victim entityAlpine Ear Nose & Throat

Incidentdiscovered Nov 19, 2024

Stated responseEngaged a specialized third-party cybersecurity firm to conduct a forensic investigation

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov