HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)PHIMediumContained

Coös County Family Health

bd_4157a034d7aa6a46 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Oct 9, 2025

To disclose

—

Affected

Not disclosed

Linked

7 records

Confidence

69%

Full breach record for Coös County Family Health →

Coos County Family Health Services notified Vermont AG on 2025-10-09 regarding unauthorized access to servers on 2025-07-09. Patient data, including names, SSNs, DOB, and medical info, may have been copied. 60 Rhode Island residents identified. Remediation includes policy review and 12 months of TransUnion credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline

Jul 9, 2025

Begins

Oct 9, 2025

Filed

This filing is one of 7 records about the same incident.View merged incident

A leak claim by runsomewares about this victim was first seen 57 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siterunsomewaresbd_b1954aa65bfd53992025-07-10 · +91dVerified

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_baf9b9fa162a0aaa2025-10-09Verified by operator
Massachusetts State AGbd_bba4837ae5e628e12025-10-09Verified by operator
New Hampshire State AGbd_f14806bbae507beb2025-10-09Verified by operator
Illinois State AGbd_6092bef5a34d0ff62025-10-01 · +8dVerified by operator

Show 1 more filing ↓up to 34d gap

HHS OCRbd_8f8dbcd50604b6cb2025-09-05 · +34dCandidate

Name: Coös County Family Health
norm: coos county family health
Domain: coosfamilyhealth.org

Name: Coös County Family Health
norm: coos county family health
Domain: coosfamilyhealth.org
Industry: Healthcarellm

Discovered: —
Breach occurred: Jul 9, 2025
Materiality determined: —
Notification sent: Oct 9, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDHealth (basic)PHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Began an investigation to determine the nature and scope of the activity
Took steps to secure our systems
Reviewed and enhancing our existing policies and procedures
Providing you with access to 12 months of free credit monitoring and identity protection services provided by TransUnion
Changes made: Reviewing and enhancing our existing policies and procedures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >30d
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

HHS OCRSep 5 · first

Illinois State AG+26d

Maine State AG+34d

Massachusetts State AG+34d

New Hampshire State AG+34d

Vermont State AG+34d · this page

Pattern: first filing Sep 5 (NH), last Oct 9 (VT) — a 34-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2025-10-09-coos-county-family-health-services-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 9, 2025
Raw hash: a13de06919c33e38560bdcf5d960c8f8b3ed3b7b05ed3862d9494100179e80f8

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityCoös County Family Health

Victim entityCoös County Family Health

IncidentUnauthorized Access

Stated responseBegan an investigation to determine the nature and scope of the activity

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov