HackingHealthcareHealthcareStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedTargetedPIIIdentity (basic)Government IDHealth (basic)Financial accountHighContained

Cumberland County Hospital

bd_43570399858a87b4 · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 3, 2025

Filed

Jun 2, 2025

To disclose

9 weeks

Affected · nationwide

36,6594 in this filing

Linked

5 filings

Confidence

66%

Full breach record for Cumberland County Hospital →

Cumberland County Hospital Association (CCH) notified the NH AG of unauthorized access to its computer system between Feb 21 and Apr 3, 2025, discovered on Apr 3, 2025. The incident exposed PII and PHI of 36,659 individuals, including 4 NH residents. Data included SSNs, health info, and billing details. CCH shut down systems, engaged cybersecurity experts, and notified law enforcement.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 41 days

discovery → filing · 9 weeks / 60 days

Feb 21, 2025

Begins

Apr 3, 2025

Discovered

Jun 2, 2025

Filed

vs. sector median

4 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

HHS OCRbd_299462013c28c58c2025-06-02Verified
Indiana State AGbd_34028cff79d57b942025-06-02Verified
Massachusetts State AGbd_691d10cc174fa3222025-06-02Verified
Illinois State AGbd_bedcc66d3db0904e2025-06-01 · +1dCandidate

Name: Cumberland County Hospital
norm: cumberland county hospital

Name: Cumberland County Hospital
norm: cumberland county hospital
Industry: Healthcarellm

Discovered: Apr 3, 2025
Breach occurred: Feb 21, 2025 – Apr 3, 2025
Undetected for: 41 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 2, 2025
Affected individuals: 36,659state + nationwide
Data types: PIIIdentity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General’s Office, Consumer Protection
Initial access: valid_credentials

During the incident: Immediately shut down all computers
Disabled data sharing connections
Contacted law enforcement
Began an investigation
Worked with outside cybersecurity experts to restore secure access
Changes made: Implement enhanced measures to prevent a similar incident from happening again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Illinois State AGJun 1 · first

HHS OCR+1d

Indiana State AG+1d

Massachusetts State AG+1d

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cumberland-county-hospital-association-20250602.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 2, 2025
Raw hash: abf7cf534dca1a535d40fe0c906d64284f417c5f7cea321426ff619c69a98b33

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityCumberland County Hospital

Victim entityCumberland County Hospital

Incidentdiscovered Apr 3, 2025

Stated responseImmediately shut down all computers

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov