AccidentalHealthcareHealthcareMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Northern Counties Health Care

bd_3176ee1578607fa7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 22, 2023

Filed

Sep 22, 2023

To disclose

≤1 day

Affected

Not disclosed

Confidence

67%

Full breach record for Northern Counties Health Care →

Northern Counties Health Care, a Vermont healthcare provider, notified consumers on September 22, 2023, that on September 19, 2023, an email containing personal information was mistakenly sent to an individual instead of Blue Cross/Blue Shield during new employee medical insurance enrollment. The disclosed data included names, addresses, SSNs, dates of birth, and banking information. The organization attempted to recall the email and contacted the recipient to delete it. Affected individuals were advised to place fraud alerts and were offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Vermont clock✓ VT AG ≤14 bday≤1 day discovery → filing

⚠ notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.

Incident timeline

undetected · 3 days

discovery → filing · ≤1 day / 0 days

Sep 19, 2023

Begins

Sep 22, 2023

Discovered

Sep 22, 2023

Filed

vs. sector median

13 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Northern Counties Health Care
norm: northern counties health care
Domain: nchcvt.org

Name: Northern Counties Health Care
norm: northern counties health care
Domain: nchcvt.org
Industry: Healthcarellm

Discovered: Sep 22, 2023
Breach occurred: Sep 19, 2023
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 22, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Attack vector: Misconfiguration
MITRE ATT&CK: T1535 Unauthorized Access to Cloud Storage

During the incident: Attempted to recall the email
Outreached to the individual to ask them not to view the email and to delete it
Working with the team to explore ways to prevent an occurrence like this from happening again in the future
Changes made: Working with the team to explore ways to prevent an occurrence like this from happening again in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: ≤1 day(0 days from discovery to filing)
Compliance flags: VT AG ≤14 bday
Discovery-date grounding: notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-09-22-northern-counties-health-care-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 22, 2023
Raw hash: 0df1f4b8511577048438ecf31eec0ff3f58af662927df7beb6997d4ee09d2cac

Reporting entityNorthern Counties Health Care

Victim entityNorthern Counties Health Care

Incidentdiscovered Sep 22, 2023

Stated responseAttempted to recall the email

ComplianceVT AG ≤14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov