HackingStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedTargetedPIIIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICFINANCIAL_ACCOUNTHighContained
Cumberland County Hospital Association
bd_43570399858a87b4 · schema v1 · pii pii-v1
Full breach record for Cumberland County Hospital Association →Cumberland County Hospital Association (CCH) notified the NH AG of unauthorized access to its computer system between Feb 21 and Apr 3, 2025, discovered on Apr 3, 2025. The incident exposed PII and PHI of 36,659 individuals, including 4 NH residents. Data included SSNs, health info, and billing details. CCH shut down systems, engaged cybersecurity experts, and notified law enforcement.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_34028cff79d57b94Indiana State AGfiled 2025-06-02Candidate
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/cumberland-county-hospital-association-20250602.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 2, 2025
- Raw hash
- abf7cf534dca1a535d40fe0c906d64284f417c5f7cea321426ff619c69a98b33
Reporting entity
- Name
- Cumberland County Hospital Associationnorm: cumberland county hospital
Victim entity
- Name
- Cumberland County Hospital Associationnorm: cumberland county hospital
Incident
- Discovered
- Apr 3, 2025
- Materiality determined
- —
- Notification sent
- Jun 2, 2025
- Affected individuals
- 36,659
- Data types
- PIIIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1119 Automated Collection
- Threat actor
- External
- Regulator citations
- Notified New Hampshire Attorney General’s Office, Consumer Protection
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 9 weeks(60 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.