MalwareHealthcareHealthcareRansomwareCapture Stored DataData EncryptedData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDPHIMediumContained

Columbia Medical Practice

bd_35449517a60b440a · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Apr 24, 2026

To disclose

—

Affected

3state residents only

Linked

4 filings

Confidence

66%

Full breach record for Columbia Medical Practice →3 incidents on file

Columbia Medical Practice, a multi-specialty primary healthcare facility in Maryland, experienced a ransomware attack on November 5, 2025. An unknown cyber actor accessed the network, installed a virus to lock files, and copied data. The incident affected approximately 3 New Hampshire residents, whose name and Social Security numbers were exposed. The organization engaged cybersecurity specialists, notified HHS and federal law enforcement, and provided credit monitoring services.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline

Nov 5, 2025

Begins

Apr 24, 2026

Filed

This filing is one of 4 about the same incident.View merged incident

A leak claim by qilin about this victim predates this filing by 170 days.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_0d3025706b44e21b2026-04-24Verified
Massachusetts State AGbd_356fb379ec1b38802026-04-24Verified by operator
HHS OCRbd_052a3d4befc213552025-12-05 · +140dVerified

Name: Columbia Medical Practice
norm: columbia medical practice

Name: Columbia Medical Practice
norm: columbia medical practice
Domain: cmpractice.com
Industry: Healthcarellm

Discovered: —
Breach occurred: Nov 5, 2025
Materiality determined: —
Notification sent: Apr 24, 2026
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government IDPHI
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified the U.S. Department of Health and Human ServicesNotified federal law enforcementFiled notice with the New Hampshire Attorney General

During the incident: Engaged cybersecurity specialists
Remediated the issue and confirmed the computer network was secure
Investigated what occurred
Undertook an intensive review of copied files to identify whose information was involved
Published notice on its website in November
Notified the U.S. Department of Health and Human Services
Notified federal law enforcement
Provided written notice to approximately three New Hampshire residents on April 24, 2026
Changes made: Implemented additional technical measures and processes to further enhance the security of our systems
Working to implement additional safeguards and training to its employees
Providing access to credit monitoring and identity restoration services for one year through TransUnion
Providing notified individuals with free resources and guidance on how to better protect against identity theft and fraud
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >90d
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

HHS OCRDec 5 · first

Maine State AG+140d

Massachusetts State AG+140d

New Hampshire State AG+140d · this page

Pattern: first filing Dec 5 (MD), last Apr 24 (NH) — a 140-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/columbia-medical-practice-20260424.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 24, 2026
Raw hash: 71bffebe43295f277722461c43ec548159ce2fe19d207fb8e0eaba2bf695649d

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityColumbia Medical Practice

Victim entityColumbia Medical Practice

IncidentRansomware

Stated responseEngaged cybersecurity specialists

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov