HackingHealthcareRetail & ConsumerHealthcareStolen CredentialsCustomer Data InvolvedDelayed DiscoveryPIIIdentity (basic)LowContained

Community Dental

bd_2b2ad1298b1d2eeb · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 17, 2023

Filed

Oct 22, 2024

To disclose

49 weeks

Affected

3state residents only

Linked

5 records

Confidence

67%

Full breach record for Community Dental →2 incidents on file

Community Dental filed a supplemental breach notification with the New Hampshire Attorney General on October 22, 2024, regarding 3 NH residents. The incident involved unauthorized access to sensitive information, discovered on November 17, 2023. Community Dental notified federal law enforcement and HHS, and is offering credit monitoring via Experian. Additional employee safeguards and training are being implemented.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d49 weeks discovery → filing

Incident timeline

discovery → filing · 49 weeks / 340 days

Nov 17, 2023

Discovered

Oct 22, 2024

Filed

vs. sector median

+39 wks slower

This filing is one of 5 records about the same incident.View merged incident

A leak claim by lockbit_3 about this victim was first seen 340 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitelockbit_3bd_2c0ea5bd713497732023-09-19 · +399dVerified by operator

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_7fdc21eb5caa3de02024-10-22Verified by operator
Maine State AGbd_eef5da71e0c26cfc2024-10-22Verified by operator
HHS OCRbd_8d67a6837dc854b72023-11-17 · +340dVerified

Name: Community Dental
norm: community dental
Domain: communitydentalme.org

Name: Community Dental
norm: community dental
Domain: communitydentalme.org
Industry: HealthcarellmRetail & Consumerllm

Discovered: Nov 17, 2023
Materiality determined: —
Notification sent: Nov 17, 2023
Affected individuals: 3state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified primary federal regulator, the U.S. Department of Health and Human ServicesNotified federal law enforcementProviding written notice of this event to appropriate state privacy regulators
Initial access: valid_credentials

During the incident: Moved quickly to investigate and respond
Assessed the security of its systems
Identified potentially affected individuals
Notified federal law enforcement
Provided access to credit monitoring and identity restoration services for individuals whose personal information was potentially affected by this event, at no cost to these individuals
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this event to appropriate state privacy regulators
Supplementing its previous notice to the U.S. Department of Health and Human Services, prominent media, and its website pursuant to the Health Insurance Portability and Accountability Act (HIPAA)
Changes made: Implementing additional safeguards and training to its employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 49 weeks(340 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

HHS OCRNov 17 · first

Massachusetts State AG+340d

Maine State AG+340d

New Hampshire State AG+340d · this page

Pattern: first filing Nov 17 (ME), last Oct 22 (NH) — a 340-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/community-dental-20241022.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 22, 2024
Raw hash: 32b050db3f5f191819423485a975024746009daba6b55e785b2c6b03536be630

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityCommunity Dental

Victim entityCommunity Dental

Incidentdiscovered Nov 17, 2023

Stated responseMoved quickly to investigate and respond

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov