HackingHealthcareTechnologyHealthcareVulnerability ExploitData ExfiltratedTargetedPHIHealth (basic)Identity (basic)Government IDMediumContained

Data Media Associates

bd_450803226b4712aa · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 4, 2023

Filed

Aug 28, 2023

To disclose

12 weeks

Affected

182state residents only

Linked

14 filings

Confidence

67%

Full breach record for Data Media Associates →4 incidents on file

Data Media Associates, LLC (DMA), a healthcare billing fulfillment provider, notified the NH AG of a data security incident involving the MOVEit Transfer vulnerability. DMA became aware of the CISA alert on June 4, 2023, and confirmed unauthorized data acquisition on June 30, 2023. 182 NH residents were notified on August 23, 2023. Affected data included PHI and personal identifiers. DMA patched the system, engaged experts, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 12 weeks / 85 days

Jun 4, 2023

Discovered

Aug 28, 2023

Filed

vs. sector median

on median

This filing is one of 14 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Delaware State AGbd_8be62e38447897d82023-08-30 · +2dVerified
HHS OCRbd_30963eb787b1cdd82023-08-24 · +4dVerified by operator
Indiana State AGbd_260b7cb119fa0ee92023-08-23 · +5dCandidate
California State AGbd_44951a0ed5c0c1c72023-08-23 · +5dVerified

Show 6 more filings ↓up to 42d gap

Montana State AGbd_721a9fed6d650d0b2023-08-23 · +5dVerified
Oregon State AGbd_9629ce6ff1f3e5c82023-08-23 · +5dVerified
Washington State AGbd_5fe69a1c32fcae1b2023-09-25 · +28dVerified
Massachusetts State AGbd_738544e5a7db48382023-09-25 · +28dVerified
Maine State AGbd_dd8d071e11b9229b2023-09-25 · +28dVerified
HHS OCRbd_54c0ed94f96132692023-10-09 · +42dVerified by operator

Showing first 10 of 13 linked disclosures.

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Name: Data Media Associates
norm: data media associates
Industry: HealthcarellmTechnologyllm

Discovered: Jun 4, 2023
Materiality determined: —
Notification sent: Aug 23, 2023
Affected individuals: 182state-resident count only
Data types: PHIHealth (basic)Identity (basic)Government ID
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Took immediate steps to patch its MOVEit system in accordance with the developer’s instructions
Undertook a comprehensive investigation with the assistance of leading external experts
Secured the affected system
Implemented all remediation measures recommended by the MOVEit software developer
Launched an investigation to determine whether, and to what extent, individual information had been accessed or acquired without authorization
Established a toll-free call center through IDX to answer questions about the incident
Offering complimentary credit and identity monitoring services to the potentially affected individuals
Changes made: Evaluating additional safeguards that can be put in place to further enhance the security of the data entrusted to it
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(85 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 10 states

View merged incident ↗

Indiana State AGAug 23 · first

California State AGAug 23 · first

Montana State AGAug 23 · first

Oregon State AGAug 23 · first

HHS OCR+1d

New Hampshire State AG+5d · this page

Delaware State AG+7d

Washington State AG+33d

Massachusetts State AG+33d

Maine State AG+33d

HHS OCR+47d

Pattern: first filing Aug 23 (IN), last Oct 9 (GA) — a 47-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 13 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/data-media-associates-20230828.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 28, 2023
Raw hash: fd4aa766f94a81c82a1fe7129954a7ce07f1f5ce61e092dc4b74a9bda3d23dfb

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityConstangy, Brooks, Smith & Prophete, LLP

Victim entityData Media Associates

Incidentdiscovered Jun 4, 2023

Stated responseTook immediate steps to patch its MOVEit system in accordance with the developer’s instructions

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov