HackingHealthcareHealthcareCustomer Data InvolvedDelayed DiscoveryPIIIDENTITY_GOVERNMENTIDENTITY_BASICMediumResolved
Behavioral Health Resources
bd_33c842a1f20e652b · schema v1 · pii pii-v1
Full breach record for Behavioral Health Resources →On or about November 20, 2024, Behavioral Health Resources (BHR), a healthcare organization in Olympia, WA, detected suspicious activity in its computer environment. An unauthorized external actor gained access to certain systems, potentially exposing name, Social Security Number, and driver's license/government-issued ID of approximately 50,083 individuals, including 4 Maine residents. No confirmed data exfiltration. Written notice was sent April 17, 2025.
Maine clockDiscovered Jan 24, 2025 → Filed with AG Apr 17, 202583d ⏱ ME AG >30d12 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_0417c58d9a8101f7Washington State AGfiled 2025-04-17Candidate
- bd_e916eb274b26c6a7Indiana State AGfiled 2025-04-17Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/75b8c0d5-40cb-4758-b573-11d4d45d52cd.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 17, 2025
- Raw hash
- 3ef1028021045545d9ed1d96e258881c40fffd4f03df3749186ebf32c63b3be4
Reporting entity
- Name
- Behavioral Health Resourcesnorm: behavioral health resources
- Domain
- bhr.org
- Industry
- Healthcare
Victim entity
- Name
- Behavioral Health Resourcesnorm: behavioral health resources
- Domain
- bhr.org
- Industry
- Healthcare
- Industry
- Healthcarellm
Incident
- Discovered
- Jan 24, 2025
- Materiality determined
- —
- Notification sent
- Apr 17, 2025
- Affected individuals
- 4
- Data types
- PIIIDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Notified U.S. Department of Health and Human Services (HHS)Notified Maine Attorney GeneralNotified three major credit reporting agencies
Compliance
- Time to disclose
- 12 weeks(83 days from discovery to filing)
- Compliance flags
- ME AG >30d · 83dME resident >60d · 83d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Jan 24, 2025→ Filed with AG: Apr 17, 202583d 30 days (soft) ME AG >30d Maine Discovered: Jan 24, 2025→ Notified: Apr 17, 202583d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.