HackingHealthcareHealthcareStolen CredentialsTargetedIdentity (basic)Health (basic)Government IDMediumContained

Cardiovascular Medicine Associates Inc.

bd_41de17d335324174 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 12, 2025

Filed

Oct 10, 2025

To disclose

17 weeks

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for Cardiovascular Medicine Associates Inc. →

Cardiovascular Medicine Associates (MyCardiologist) notified the NH AG of a data event affecting 1 NH resident. Unauthorized access to the email environment occurred May 30, 2025, discovered June 12, 2025. Data included names, addresses, clinical info, DOB, Medicare numbers. Contained and remediated; 24-month credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 13 days

discovery → filing · 17 weeks / 120 days

May 30, 2025

Begins

Jun 12, 2025

Discovered

Oct 10, 2025

Filed

vs. sector median

+5 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_e21470a62a33551f2025-10-06 · +4dVerified

Name: GOODWIN PROCTER LLP
norm: goodwin procter
Domain: goodwinlaw.com

Name: Cardiovascular Medicine Associates Inc.
norm: cardiovascular medicine associates
Domain: cvmaonline.com
Also named: Cardiovascular Medicine Associates, PAdba oflegal entity
MyCardiologistdba oftrade name
Industry: Healthcarellm

Discovered: Jun 12, 2025
Breach occurred: May 30, 2025 – Jun 12, 2025
Undetected for: 13 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 7, 2025
Affected individuals: 1state-resident count only
Data types: Identity (basic)Health (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified New Hampshire Office of the Attorney General pursuant to N.H. Rev. Stat. Ann. §§ 359-C:20
Initial access: valid_credentials

During the incident: Initiated its incident response protocols
Began an investigation with the assistance of forensic investigators
Moved quickly to contain and remediate the Incident
Worked with a data analytics firm to conduct a comprehensive review of the impacted data
Conducted an internal review of records to locate certain missing address information
Reviewed its existing policies and procedures and implemented additional safeguards
Provided written notice of the Incident to potentially impacted individuals
Offered complimentary access to credit monitoring and identity restoration services for twenty-four (24) months through EPIQ
Changes made: Implemented additional safeguards to further secure its systems and the information contained therein
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(120 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

HHS OCROct 6 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cardivascular-medicine-mycardiologist-20251010.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 10, 2025
Raw hash: 3827cdb7acbd45e00d79bdeebeb59e38019542f8051b354701425171040ab179

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityGOODWIN PROCTER LLP

Victim entityCardiovascular Medicine Associates Inc.

Incidentdiscovered Jun 12, 2025

Stated responseInitiated its incident response protocols

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov