HackingCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTHighResolved
Mercy Hospital, Iowa City, Iowa
bd_2a28526c953d48e1 · schema v1 · pii pii-v1
Full breach record for Mercy Hospital, Iowa City, Iowa →Mercy Iowa City, a healthcare provider, reported an external system breach (hacking) occurring on May 15, 2020, discovered on October 3, 2020. The incident affected 92,795 individuals, including 5 Maine residents. Compromised data included names and Social Security Numbers. The entity notified affected individuals in writing on November 13, 2020, and offered one year of identity theft protection services.
Maine clockDiscovered Oct 3, 2020 → Filed with AG Nov 13, 202041d ⏱ ME AG >30d6 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_cb229a485f2d826bHHS OCRfiled 2020-11-13Candidate
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/2bb0da76-5557-4f07-b6f3-819f262ecf60.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Nov 13, 2020
- Raw hash
- f0a17eff59f1c631ed10813524be5407c7023c3c398e02796b23b3bf9e7d670b
Reporting entity
- Name
- Mercy Hospital, Iowa City, Iowanorm: mercy hospital iowa city iowa
Victim entity
- Name
- Mercy Hospital, Iowa City, Iowanorm: mercy hospital iowa city iowa
Incident
- Discovered
- Oct 3, 2020
- Materiality determined
- —
- Notification sent
- Nov 13, 2020
- Affected individuals
- 92,795
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed notification with Maine Attorney General
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 6 weeks(41 days from discovery to filing)
- Compliance flags
- ME AG >30d · 41d
- Discovery-date grounding
- AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Oct 3, 2020→ Filed with AG: Nov 13, 202041d 30 days (soft) ME AG >30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.