HackingData ExfiltratedTargetedIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICFINANCIAL_ACCOUNTMediumActive
Harbor
bd_2f540137b6d03267 · schema v1 · pii pii-v1
Full breach record for Harbor →Harbor, a healthcare provider in Toledo, OH, notified the NH AG of a data event affecting 3 NH residents. Unauthorized access occurred July 25–Aug 1, 2025; detected Aug 1, 2025. Data included PII (SSN, DL), PHI, and financial info. Notices sent Sept 30, 2025. Investigation ongoing.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_2553d8403fd8364bMaine State AGfiled 2025-10-24Verified
- bd_9a4998fa85b306a6Vermont State AGfiled 2025-10-24Verified
- bd_d4a34d6895ce7979Montana State AGfiled 2025-10-24Verified
- bd_7bfe7b23f5f210c7HHS OCRfiled 2025-09-30(24d gap)Candidate
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/harbor-20251024.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 24, 2025
- Raw hash
- f765569361959b20d4d44bc039a0de83576366b4c3adc885e3115ca057ac0300
Reporting entity
- Name
- Mullen Coughlin LLCnorm: mullen coughlin
Victim entity
- Name
- Harbornorm: harbor
- Domain
- goharbor.io
Incident
- Discovered
- Aug 1, 2025
- Materiality determined
- —
- Notification sent
- Sep 30, 2025
- Affected individuals
- 3
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1119 Automated Collection
- Threat actor
- External
- Regulator citations
- Notified U.S. Department of Health and Human Services pursuant to HIPAAProviding written notice to relevant state and federal regulatorsNotifying the three major credit reporting agencies, Equifax, Experian, and TransUnion
Compliance
- Time to disclose
- 12 weeks(84 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.