HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedPHIIdentity (basic)LowContained

Coastal Hospice

bd_398ce6ad535153b5 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 24, 2023

Filed

Jan 24, 2024

To disclose

26 weeks

Affected

2state residents only

Linked

6 filings

Confidence

66%

Full breach record for Coastal Hospice →

Coastal Hospice & Palliative Care experienced a network disruption on July 24, 2023, which led to the unauthorized acquisition of certain files. An investigation determined that personal and protected health information (PHI) of two New Hampshire residents was potentially impacted. The organization engaged cybersecurity experts, secured its network, notified the FBI, and offered credit monitoring services to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 26 weeks / 184 days

Jul 24, 2023

Begins

Jul 24, 2023

Discovered

Jan 24, 2024

Filed

vs. sector median

+14 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_6c32a84bb70307122024-01-24Verified
Indiana State AGbd_03e39b52a31cd9e62024-01-22 · +2dVerified
Delaware State AGbd_2f965f119e2bb7032024-01-22 · +2dVerified
Vermont State AGbd_5ced0bd3806c1b472024-01-22 · +2dVerified

Show 1 more filing ↓up to 2d gap

HHS OCRbd_bb2567743c8e9fc42024-01-22 · +2dVerified

Name: Coastal Hospice
norm: coastal hospice
Domain: coastalhospice.org

Name: Coastal Hospice
norm: coastal hospice
Domain: coastalhospice.org
Industry: Healthcarellm

Discovered: Jul 24, 2023
Breach occurred: Jul 24, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 22, 2024
Affected individuals: 2state-resident count only
Data types: PHIIdentity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified the Federal Bureau of Investigation

During the incident: Initiated an investigation of the matter
Engaged cybersecurity experts to assist with the process
Took steps to secure its network environment
Notified the Federal Bureau of Investigation of the incident
Changes made: Implemented measures to enhance the security of its environment
Offering complimentary credit monitoring and identity protection services through Equifax
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(184 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGJan 22 · first

Delaware State AGJan 22 · first

Vermont State AGJan 22 · first

HHS OCRJan 22 · first

Massachusetts State AG+2d

New Hampshire State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/coastal-hospice-palliative-care-20240124.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 24, 2024
Raw hash: 9a6a059ee424580a87aebe25c6fb95652e362269316f0f1f77d3e91655b76270

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityCoastal Hospice

Victim entityCoastal Hospice

Incidentdiscovered Jul 24, 2023

Stated responseInitiated an investigation of the matter

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov