HackingHealthcareHealthcareStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDMediumContained

MelroseWakefield Healthcare, Inc.

bd_2f34b9a6e158b7a9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 20, 2020

Filed

Jul 10, 2020

To disclose

16 weeks

Affected

259state residents only

Confidence

66%

Full breach record for MelroseWakefield Healthcare, Inc. →4 incidents on file

MelroseWakefield Healthcare, Inc. notified the NH AG of a third-party vendor breach involving PaperlessPay. Unauthorized access occurred on Feb 18, 2020, affecting 259 NH residents' names, addresses, and SSNs. Melrose provided 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 31 days

discovery → filing · 16 weeks / 112 days

Feb 18, 2020

Begins

Mar 20, 2020

Discovered

Jul 10, 2020

Filed

vs. sector median

+5 wks slower

Part of PaperlessPay Corporation supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed259 affectedView incident

Name: MelroseWakefield Healthcare, Inc.
norm: melrosewakefield healthcare

Name: MelroseWakefield Healthcare, Inc.
norm: melrosewakefield healthcare
Industry: Healthcarellm

Discovered: Mar 20, 2020
Breach occurred: Feb 18, 2020
Undetected for: 31 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 2, 2020
Affected individuals: 259state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Office of the New Hampshire Attorney General
Initial access: supply_chain

During the incident: Worked to obtain additional information from Paperless Pay on their investigation, findings and the individuals whose information may have been in their database at the time of this event
Working to remove all W2 data from PaperlessPay's systems
Working with PaperlessPay to ensure all data related to its employees is returned to Melrose and removed from PaperlessPay's system
Providing access to credit monitoring services for twenty-four (24) months, through Experian, to individuals whose personal information was potentially affected by this incident, at no cost to these individuals
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Providing access to credit monitoring services for twenty-four (24) months, through Experian, to individuals whose personal information was potentially affected by this incident, at no cost to these individuals
Providing impacted individuals with guidance on how to better protect against identity theft and fraud, including advising individuals to report any suspected incidents of identity theft or fraud
Providing individuals with information on how to place a fraud alert and security freeze on one's credit file
Encouraging individuals to contact the Federal Trade Commission, their state Attorney General, and law enforcement to report attempted or actual identity theft and fraud
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(112 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/melrose-wakefield-healthcare-20200710.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 10, 2020
Raw hash: acc2d973efe0a512558f77a8521e7052e2ec1f3d2b2011a703b03e191700052c

Reporting entityMelroseWakefield Healthcare, Inc.

Victim entityMelroseWakefield Healthcare, Inc.

Incidentdiscovered Mar 20, 2020

Stated responseWorked to obtain additional information from Paperless Pay on their investigation, findings and the individuals whose information may have been in their database at the time of this event

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov