MalwareHealthcareProfessional ServicesHealthcareRansomwareStolen CredentialsData EncryptedData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedDelayed DiscoveryGovernment IDIdentity (basic)PHIHealth (basic)EmploymentMediumContained

Canopy Children's Solutions

bd_465f5916b3af5783 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 4, 2023

Filed

Apr 11, 2024

To disclose

12 months

Affected

6state residents only

Confidence

65%

Full breach record for Canopy Children's Solutions →2 incidents on file

Canopy Children's Solutions discovered encrypted files on its network on April 4, 2023, indicating a ransomware attack. An unauthorized actor gained access to systems and may have accessed or acquired files containing personal information, including Social Security numbers, of current and former members, employees, and healthcare recipients. The incident affected 6 New Hampshire residents. Canopy engaged forensic specialists, notified law enforcement and regulators (including HHS), and is offering 12 months of credit monitoring via Experian to affected individuals with exposed SSNs.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d12 months discovery → filing

Incident timeline

discovery → filing · 12 months / 373 days

Apr 4, 2023

Begins

Apr 4, 2023

Discovered

Apr 11, 2024

Filed

vs. sector median

+41 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed6 affectedView incident

Name: Canopy Children's Solutions
norm: canopy children s
Domain: mycanopy.org

Name: Canopy Children's Solutions
norm: canopy children s
Domain: mycanopy.org
Industry: HealthcarellmProfessional Servicesllm

Discovered: Apr 4, 2023
Breach occurred: Apr 4, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 11, 2024
Affected individuals: 6state-resident count only
Data types: Government IDIdentity (basic)PHIHealth (basic)Employment
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified federal law enforcementNotifying applicable regulators, including the U.S. Department of Health and Human ServicesProviding written notice to relevant state and federal regulators

During the incident: Took steps to secure our systems
Launched an investigation into the full nature and scope of the event with the assistance of third-party forensic specialists
Notified federal law enforcement regarding the event
Implemented additional safeguards and training to its employees
Providing access to credit monitoring services for 12 months through Experian to individuals whose Social Security number was potentially affected
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing individuals with information on how to place a fraud alert and security freeze on one’s credit file
Providing written notice of this incident to relevant state and federal regulators
Providing written notice to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Changes made: Implemented additional security measures to further protect against similar incidents moving forward
Implemented additional safeguards and training to its employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 months(373 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/mississippi-childrens-home-society-canopy-childrens-solutions-20240411.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 11, 2024
Raw hash: 1030316d902383e9792bb198faaaa83a270daca2ebe549e8a7d1405a40469cea

Reporting entityCanopy Children's Solutions

Victim entityCanopy Children's Solutions

Incidentdiscovered Apr 4, 2023

Stated responseTook steps to secure our systems

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov