MalwareRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Columbia Medical Practice
bd_35449517a60b440a · schema v1 · pii pii-v1
Full breach record for Columbia Medical Practice →Columbia Medical Practice notified the New Hampshire Attorney General on April 24, 2026, of a November 5, 2025 incident where an unknown cyber actor accessed its network, installed ransomware to lock files, and exfiltrated patient data including names and Social Security numbers. Approximately 3 New Hampshire residents were affected. The company engaged cybersecurity specialists, notified law enforcement and HHS, and provided one year of credit monitoring via TransUnion.
Leak gap clock⏱ Leak >90d24 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3 affectedView incident
A leak claim by qilin about this victim predates this filing by 170 days.View originating leak claim
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/columbia-medical-practice-20260424.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 24, 2026
- Raw hash
- 71bffebe43295f277722461c43ec548159ce2fe19d207fb8e0eaba2bf695649d
Reporting entity
- Name
- Mullen Coughlin LLCnorm: mullen coughlin
Victim entity
- Name
- Columbia Medical Practicenorm: columbia medical practice
- Domain
- cmpractice.com
- Industry
- healthcare
Incident
- Discovered
- Nov 5, 2025
- Materiality determined
- —
- Notification sent
- Apr 24, 2026
- Affected individuals
- 3
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Ransomware
- MITRE ATT&CK
- T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified the U.S. Department of Health and Human ServicesNotified federal law enforcement
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 24 weeks(170 days from discovery to filing)
- Compliance flags
- Leak >90d
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.