HackingHealthcareHealthcareStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedGovernment IDIdentity (basic)Financial accountHealth (basic)HighContained

Coös County Family Health

bd_4157a034d7aa6a46 · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 1, 2025

Filed

Oct 9, 2025

To disclose

5 weeks

Affected

3,200scope not determined

Linked

7 filings

Confidence

66%

Full breach record for Coös County Family Health →

Coos County Family Health Services experienced a data breach in September 2025 involving unauthorized access to patient records. The incident exposed names, dates of birth, Social Security numbers, and financial account information for approximately 3,200 individuals. The organization engaged forensic investigators, notified law enforcement, and sent notification letters to affected individuals. Remediation efforts included enhanced security safeguards, staff retraining, and offering two years of free credit and identity theft protection.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d5 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 5 weeks / 38 days

Sep 1, 2025

Begins

Sep 1, 2025

Discovered

Oct 9, 2025

Filed

vs. sector median

7 wks faster

This filing is one of 7 about the same incident.View merged incident

A leak claim by runsomewares about this victim predates this filing by 91 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siterunsomewaresbd_b1954aa65bfd53992025-07-10 · +91dVerified

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_baf9b9fa162a0aaa2025-10-09Verified by operator
Massachusetts State AGbd_bba4837ae5e628e12025-10-09Verified by operator
New Hampshire State AGbd_f14806bbae507beb2025-10-09Verified by operator
Illinois State AGbd_6092bef5a34d0ff62025-10-01 · +8dVerified by operator

Show 1 more filing ↓up to 34d gap

HHS OCRbd_8f8dbcd50604b6cb2025-09-05 · +34dCandidate

Name: Coös County Family Health
norm: coos county family health
Domain: coosfamilyhealth.org

Name: Coös County Family Health
norm: coos county family health
Domain: coosfamilyhealth.org
Industry: Healthcarellm

Discovered: Sep 1, 2025
Breach occurred: Sep 1, 2025 – Sep 30, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 9, 2025
Affected individuals: 3,200scope not determined
Data types: Government IDIdentity (basic)Financial accountHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Filed notice with Vermont Attorney General
Initial access: valid_credentials

During the incident: Engaged forensic investigators
Notified law enforcement
Sent notification letters to affected individuals
Offered free credit monitoring for 2 years
Offered free identity theft protection for 2 years
Changes made: Implemented additional administrative and technical safeguards
Retrained staff on security policies
Enhanced encryption of sensitive data
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(38 days from discovery to filing)
Compliance flags: Leak >90d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

HHS OCRSep 5 · first

Illinois State AG+26d

Maine State AG+34d

Massachusetts State AG+34d

New Hampshire State AG+34d

Vermont State AG+34d · this page

Pattern: first filing Sep 5 (NH), last Oct 9 (VT) — a 34-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2025-10-09-coos-county-family-health-services-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 9, 2025
Raw hash: f270864876fc03da439ce61d6d6eea7d658a8308c18c139b367915bc9778d727

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityCoös County Family Health

Victim entityCoös County Family Health

Incidentdiscovered Sep 1, 2025

Stated responseEngaged forensic investigators

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov