AccidentalHealthcareProfessional ServicesHealthcareMisdeliveryCustomer Data InvolvedGovernment IDPIIHighContained

Eastern Connecticut Health Network

bd_317d32199431f3dd · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 29, 2010

Filed

May 13, 2010

To disclose

14 days

Affected

3,178scope not determined

Confidence

66%

Full breach record for Eastern Connecticut Health Network →2 incidents on file

Mercier reported a data breach involving the Eastern Connecticut Health Network, Inc. Pension Plan. On April 26, 2010, an Annual Funding Notice containing participants' Social Security Numbers was inadvertently printed on mailing labels. The breach was discovered on April 29, 2010, affecting 3,178 individuals. Mercer retained Kroll Inc. to provide credit monitoring and identity restoration services to affected participants.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

discovery → filing · 14 days

Apr 26, 2010

Begins

Apr 29, 2010

Discovered

May 13, 2010

Filed

vs. sector median

7 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3,178 affectedView incident

Name: Mercer
norm: mercer
Domain: mercer.com

Name: Eastern Connecticut Health Network
norm: eastern connecticut health network
Industry: HealthcarellmProfessional Servicesllm

Discovered: Apr 29, 2010
Breach occurred: Apr 26, 2010
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 3,178scope not determined
Data types: Government IDPII
Data elements: Social Security number
Attack vector: Misconfiguration
MITRE ATT&CK: T1566.001 Spearphishing Attachment

During the incident: Contacted law enforcement
Determine what information may have been compromised
Alerting these individuals about the situation
Retained Kroll Inc. to provide toll-free access to Kroll’s Consumer Solutions Center, along with credit monitoring services and identity restoration services
Changes made: Fortify the protective measures that were already in place
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 days(14 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/mercier-20100513.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 13, 2010
Raw hash: 3e027aa990710581ae312aaab3a7008c0592e664d2032096a654f0afc67f5863

Reporting entityMercer

Victim entityEastern Connecticut Health Network

Incidentdiscovered Apr 29, 2010

Stated responseContacted law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov