HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedPHIIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

Iroquois Memorial Hospital

bd_2aca60bc54ce77c8 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Nov 10, 2025

Filed

Oct 14, 2026

To disclose

48 weeks

Affected

11state residents only

Linked

8 records

Confidence

70%

Full breach record for Iroquois Memorial Hospital →2 incidents on file

Iroquois Memorial Hospital discovered unauthorized access to its network on November 10, 2025. An investigation determined an unauthorized third party accessed the network between October 8, 2025, and November 15, 2025, and may have acquired files containing personal information. The incident affected 11 New Hampshire residents. Affected data included names, dates of birth, Social Security numbers, medical treatment/diagnosis information, and health insurance information. The hospital engaged forensic investigators, notified law enforcement and HHS OCR, and is offering credit monitoring to affected individuals with exposed SSNs.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d48 weeks discovery → filing

Incident timeline

undetected · 33 days

discovery → filing · 48 weeks / 338 days

Oct 8, 2025

Begins

Nov 10, 2025

Discovered

Oct 14, 2026

Filed

vs. sector median

+39 wks slower

This filing is one of 8 records about the same incident.View merged incident

A leak claim by pear about this victim was first seen 307 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitepearbd_1721088b597887632025-11-25 · +323dCandidate

Regulatory filings (6) · sorted by filing gap

Vermont State AGbd_04e55b31676cf65d2026-10-14Verified by operator
Texas State AGbd_be3f55921ddcf0572026-10-16 · +2dCandidate
Massachusetts State AGbd_4921ad6f201832cf2026-10-01 · +13dVerified by operator
Texas State AGbd_d8516e9249704b9e2026-09-29 · +15dVerified by operator

Show 2 more filings ↓up to 286d gap

HHS OCRbd_35f9609ed9cd4e812026-01-09 · +278dVerified
Illinois State AGbd_2beb6622c068e2d22026-01-01 · +286dCandidate

Name: Polsinelli (on behalf of Iroquois Memorial Hospital)
norm: polsinelli on behalf of iroquois memorial hospital

Name: Iroquois Memorial Hospital
norm: iroquois memorial hospital
Domain: iroquoismemorial.com
Industry: Healthcarellm

Discovered: Nov 10, 2025
Breach occurred: Oct 8, 2025 – Nov 15, 2025
Undetected for: 33 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 14, 2026
Affected individuals: 11state-resident count only
Data types: PHIIdentity (basic)Government IDHealth (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified the U.S. Department of Health and Human Services Office for Civil Rights on January 9, 2026Reporting the incident pursuant to N.H. REV. STAT. ANN. § 359-C:20

During the incident: Promptly began an internal investigation
Worked to secure its systems
Communicated with law enforcement
Engaged a forensic security firm to assist with its investigation
Engaged a dedicated eDiscovery vendor to conduct a comprehensive review of the involved files
Notified the U.S. Department of Health and Human Services Office for Civil Rights
Validated the results and located current contact information for those individuals
Notifying the involved individuals via first-class United States mail
Offering free credit monitoring services to individuals whose Social Security numbers were potentially involved
Changes made: Enhancing its technical safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 48 weeks(338 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 5 states

View merged incident ↗

Illinois State AGJan 1 · first

HHS OCR+8d

Texas State AG+271d

Massachusetts State AG+273d

Vermont State AG+286d

New Hampshire State AG+286d · this page

Texas State AG+288d

Pattern: first filing Jan 1 (IL), last Oct 16 (TX) — a 288-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/iroquois-memorial-hospital-20261014.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 14, 2026
Raw hash: f5d52fbf13972f642e073b30407838d847f05f4b88df41e4bad55e3459ef89e9

Linked disclosures

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Reporting entityPolsinelli (on behalf of Iroquois Memorial Hospital)

Victim entityIroquois Memorial Hospital

Incidentdiscovered Nov 10, 2025

Stated responsePromptly began an internal investigation

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov