HackingHealthcareHealthcareCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

County of Murray

bd_2daee386fb474bfc · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 21, 2025

Filed

Mar 13, 2026

To disclose

29 weeks

Affected

9state residents only

Linked

5 filings

Confidence

67%

Full breach record for County of Murray →

Murray County Medical Center (MCMC) notified the New Hampshire Attorney General of a data security incident affecting 9 NH residents. Suspicious activity was initially detected on August 21, 2025, and confirmed on January 27, 2026. The incident involved unauthorized access to patient/employee data, potentially including names and Social Security numbers. MCMC engaged forensic investigators, implemented security hardening, and mailed notifications offering 12 months of identity protection via Experian. No evidence of misuse was found.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 29 weeks / 204 days

Aug 21, 2025

Discovered

Mar 13, 2026

Filed

vs. sector median

+17 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_d168c222d38413112026-03-13Verified
Texas State AGbd_921f6ad032a612da2026-03-09 · +4dVerified
HHS OCRbd_000da1faa575ecc52026-03-06 · +7dVerified
Montana State AGbd_94cd0ad14c02c6652026-03-06 · +7dVerified

Name: County of Murray
norm: county of murray

Name: County of Murray
norm: county of murray
Also named: County of Murraydba oflegal entity
Murray County Medical Centerdba oftrade name
Industry: Healthcarellm

Discovered: Aug 21, 2025
Materiality determined: —
Notification sent: Mar 6, 2026
Affected individuals: 9state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General

During the incident: Engaged a leading cybersecurity firm to investigate
Retained cybersecurity experts and launched a forensics investigation
Implemented additional security measures to further harden its digital environment
Mailed notification letters to affected New Hampshire residents by USPS First Class Mail
Offered 12 months of complimentary identity protection services through Experian
Changes made: Implemented additional security measures to further harden its digital environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 weeks(204 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

HHS OCRMar 6 · first

Montana State AGMar 6 · first

Texas State AG+3d

Massachusetts State AG+7d

New Hampshire State AG+7d · this page

Pattern: first filing Mar 6 (MN), last Mar 13 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/murray-county-medical-center-20260313.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 13, 2026
Raw hash: 46edfbd9e5c5403ece27a0c5356e87826f38786a23d10702ec900d07208a91ad

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityCounty of Murray

Victim entityCounty of Murray

Incidentdiscovered Aug 21, 2025

Stated responseEngaged a leading cybersecurity firm to investigate

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov