MalwareHealthcareHealthcareRansomwareStolen CredentialsRansom DemandedRansom PaidData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDPHIHealth (basic)MediumContained

NEIGHBORHOOD HEALTHCARE

bd_2ef8bb246b705044 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 24, 2020

Filed

Apr 8, 2021

To disclose

19 weeks

Affected

4state residents only

Linked

5 filings

Confidence

64%

Full breach record for NEIGHBORHOOD HEALTHCARE →3 incidents on file

Neighborhood Healthcare notified Montana residents of a ransomware incident involving third-party hosting provider Netgain. Attackers encrypted files and exfiltrated data including PHI, SSNs, and DOB. Netgain paid a ransom. Neighborhood Healthcare engaged experts, switched providers, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 19 weeks / 135 days

Nov 24, 2020

Begins

Nov 24, 2020

Discovered

Mar 16, 2021

Scope determined

Apr 8, 2021

Filed

vs. sector median

+7 wks slower

This filing is one of 5 about the same incident.View merged incident

Part of Netgain Networks supply-chain incident (2021) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

California State AGbd_8aaf06ac833493f32021-04-08Candidate
Indiana State AGbd_b955947cb8fc4eec2021-04-08Verified
New Hampshire State AGbd_bb6f3e4aec00ab002021-04-09 · +1dVerified
HHS OCRbd_57b894cf856fcd162021-04-14 · +6dVerified

Name: NEIGHBORHOOD HEALTHCARE
norm: neighborhood healthcare

Name: NEIGHBORHOOD HEALTHCARE
norm: neighborhood healthcare
Industry: Healthcarellm

Discovered: Nov 24, 2020
Breach occurred: Nov 24, 2020 – Dec 3, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: Mar 16, 2021
Notification sent: Apr 8, 2021
Affected individuals: 4state-resident count only
Data types: Identity (basic)Government IDPHIHealth (basic)
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Third party: via Netgain
Initial access: valid_credentials

During the incident: Netgain took additional measures to contain the threat and address the issue
Netgain’s technical teams worked closely with third-party experts to remove the threat
Neighborhood Healthcare conducted an investigation into the incident with the assistance outside experts
Neighborhood Healthcare transitioned to a new hosting provider
Netgain paid a significant amount to the attacker
Netgain’s cybersecurity experts conducted regular dark web scans
Changes made: Netgain implemented international Geo-fencing for Azure-hosted environments
Netgain deployed additional log monitoring across all servers
Netgain hardened network security rules and protocols to restrict lateral movement
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(135 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

California State AGApr 8 · first

Indiana State AGApr 8 · first

Montana State AGApr 8 · first · this page

New Hampshire State AG+1d

HHS OCR+6d

Pattern: first filing Apr 8 (CA), last Apr 14 (CA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Neighbor-Notif.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 8, 2021
Raw hash: 3c68903a1f342aabe90d8bb572e48f0342bbfeb3e9d97fa606aa4c666b7b8ebc

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityNEIGHBORHOOD HEALTHCARE

Victim entityNEIGHBORHOOD HEALTHCARE

Incidentdiscovered Nov 24, 2020

Stated responseNetgain took additional measures to contain the threat and address the issue

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov