HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedData ExfiltratedIdentity (basic)Government IDHealth (basic)PHICredentialsMediumActive

The Home for Little Wanderers

bd_445dcc51eb4e58a2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 28, 2020

Filed

Jun 7, 2021

To disclose

23 weeks

Affected

46state residents only

Confidence

66%

Full breach record for The Home for Little Wanderers →8 incidents on file

The Home for Little Wanderers reported a data event affecting 46 New Hampshire residents. Unauthorized access to employee email accounts occurred between Nov 10 and Dec 31, 2020. The organization discovered the incident on Dec 28, 2020. Compromised data included names, SSNs, DOBs, medical records, and credentials. The organization engaged forensic specialists, reset credentials, and provided 2 years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 48 days

discovery → filing · 23 weeks / 161 days

Nov 10, 2020

Begins

Dec 28, 2020

Discovered

Jun 7, 2021

Filed

vs. sector median

+12 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed46 affectedView incident

Name: The Home for Little Wanderers
norm: the home for little wanderers
Domain: thehome.org

Name: The Home for Little Wanderers
norm: the home for little wanderers
Domain: thehome.org
Industry: Healthcarellm

Discovered: Dec 28, 2020
Breach occurred: Nov 10, 2020 – Dec 31, 2020
Undetected for: 48 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 5, 2021
Affected individuals: 46state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHICredentials
Data elements: Social Security numberDate of birthMedical information
Attack vector: Phishing
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: reporting this incident to the U.S. Department of Health and Human Services and state regulators
Initial access: valid_credentials

During the incident: Launched an investigation, with the assistance of third-party forensic specialists
Began an extensive review of the email accounts
Providing written notice to affected individuals
Providing access to credit monitoring services for two (2) years, through Kroll
Issuing a press release to statewide media
Posting notice on the home page of its website
Reset the employees’ email credentials
Reviewing existing security policies and procedures
Changes made: Implementing additional safeguards and training to its employees
Reviewing existing security policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(161 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/home-little-wanderers-20210607.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 7, 2021
Raw hash: efd89e567cc1cde94fdc574ede0d2993519d0ced69aea65c22464796868cb5a1

Reporting entityThe Home for Little Wanderers

Victim entityThe Home for Little Wanderers

Incidentdiscovered Dec 28, 2020

Stated responseLaunched an investigation, with the assistance of third-party forensic specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov