HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedPHIHealth (basic)Identity (basic)Government IDFinancialMediumContained

Capital Region Medical Center

bd_32f439e24ceb5bee · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 17, 2021

Filed

Mar 25, 2022

To disclose

14 weeks

Affected

4state residents only

Linked

6 filings

Confidence

66%

Full breach record for Capital Region Medical Center →

Capital Region Medical Center (CRMC) experienced a cybersecurity incident on December 17, 2021, where an unauthorized third party gained access to files containing personal and health information of patients and employees. The incident affected four New Hampshire residents. Data exposed included names, dates of birth, addresses, medical information, health insurance information, and potentially Social Security and driver's license numbers. CRMC disabled its network, engaged forensic investigators, and notified law enforcement. Credit monitoring was offered to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 14 weeks / 98 days

Dec 17, 2021

Begins

Dec 17, 2021

Discovered

Mar 25, 2022

Filed

vs. sector median

+2 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_9adc7a8104cf5c602022-03-25Verified
Montana State AGbd_c8480a3cbc771a482022-03-25Verified
Indiana State AGbd_6299b52aa0fbf0cf2022-03-24 · +1dVerified by operator
Massachusetts State AGbd_e52487bfa623bfbc2022-03-30 · +5dCandidate

Show 1 more filing ↓up to 14d gap

HHS OCRbd_7ab7349dfcd1fd472022-03-11 · +14dVerified by operator

Name: Capital Region Medical Center
norm: capital region medical center
Domain: crmc.org

Name: Capital Region Medical Center
norm: capital region medical center
Domain: crmc.org
Industry: Healthcarellm

Discovered: Dec 17, 2021
Breach occurred: Dec 17, 2021 – Dec 17, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 24, 2022
Affected individuals: 4state-resident count only
Data types: PHIHealth (basic)Identity (basic)Government IDFinancial
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified the Consumer Protection Bureau, Office of the Attorney General, New Hampshire

During the incident: Disabled its network as a security measure
Engaged a third-party cybersecurity firm
Initiated an investigation into the incident
Notified law enforcement
Provided notice of the incident to the public via CRMC’s Facebook page and media reporting
Retained a data review firm to identify personal information in the impacted files
Engaged another third-party company to help identify the most current address for impacted individuals
Began notifying the individuals and regulators
Changes made: Offering credit monitoring services to all individuals whose Social Security number or driver’s license number was potentially involved
Continues to evaluate its security practices
Will continue to identify opportunities to implement additional cybersecurity measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(98 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

HHS OCRMar 11 · first

Indiana State AG+13d

Maine State AG+14d

Montana State AG+14d

New Hampshire State AG+14d · this page

Massachusetts State AG+19d

Pattern: first filing Mar 11 (MO), last Mar 30 (MA) — a 19-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/capital-region-medical-center-20220325.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 25, 2022
Raw hash: fb3353eb3248da235bfe190f9cae48e102ca562c17b18b56a174f35e7f0c04fc

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityCapital Region Medical Center

Victim entityCapital Region Medical Center

Incidentdiscovered Dec 17, 2021

Stated responseDisabled its network as a security measure

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov