MisuseHealthcareProfessional ServicesHealthcarePrivilege AbuseEmployee Data InvolvedCustomer Data InvolvedPHIHealth (basic)Government IDIdentity (basic)MediumContained

Easterseals

bd_42336d78bbea1534 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 23, 2021

Filed

Jun 3, 2021

To disclose

10 weeks

Affected

Not disclosed

Confidence

67%

Full breach record for Easterseals →2 incidents on file

Easterseals New Hampshire notified the NH Attorney General of a security breach involving client PHI and SSNs. Two former per diem employees accessed the EHR system after termination due to an administrative error in revoking access. Affected records included clinical notes, incident reports, and SSNs. Notices were mailed to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 weeks / 72 days

Mar 23, 2021

Discovered

Jun 3, 2021

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Easterseals
norm: easterseals
Domain: easterseals.com

Name: Easterseals
norm: easterseals
Domain: easterseals.com
Industry: HealthcarellmProfessional Servicesllm

Discovered: Mar 23, 2021
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Government IDIdentity (basic)
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: insider_action

During the incident: Conducted a thorough investigation to determine what records and information the former employee accessed
Mailed notices to the affected individuals in accordance with the Health Insurance Portability Act (HIPAA) and RSA 359-C:20
Retraining of staff
Examination of existing policies and procedures
Changes made: Retraining of staff
Examination of existing policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(72 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/easterseals-new-hampshire-20210603.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 3, 2021
Raw hash: b7b068c020b094c2e31144ddd20d2ad85477fe0385836a4f78418ded5539d14c

Reporting entityEasterseals

Victim entityEasterseals

Incidentdiscovered Mar 23, 2021

Stated responseConducted a thorough investigation to determine what records and information the former employee accessed

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov