HackingHealthcareHealthcareData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)PHIMediumContained

Bayhealth Medical Center

bd_470d92e7afe21bde · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 31, 2024

Filed

Feb 3, 2025

To disclose

27 weeks

Affected

257state residents only

Linked

11 filings

Confidence

66%

Full breach record for Bayhealth Medical Center →4 incidents on file

Bayhealth Medical Center reported an external system breach (hacking) occurring between July 27 and July 31, 2024. The incident compromised PHI, SSNs, driver's licenses, and names. 257 Maine residents were notified on February 3, 2025. The organization engaged forensic specialists, notified law enforcement, and provided 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jul 31, 2024 → Filed with AG Feb 3, 2025187d ✗ ME AG >90d27 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 4 days

discovery → filing · 27 weeks / 187 days

Jul 27, 2024

Begins

Jul 31, 2024

Discovered

Feb 3, 2025

Filed

vs. sector median

+15 wks slower

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siterhysidabd_186c09df44f3bb052024-08-07 · +179dVerified

Regulatory filings (9) · sorted by filing gap

Montana State AGbd_362157ac2cddd0182025-02-03Verified
Nebraska State AGbd_6d649b7cadf1148b2025-02-03Verified
New Hampshire State AGbd_79aca51b0000ac772025-02-03Verified
California State AGbd_950fc141689784702025-02-03Verified

Show 5 more filings ↓up to 122d gap

Vermont State AGbd_a959cc94549ef9562025-02-03Verified
Massachusetts State AGbd_d8e00c7d2babf4692025-02-03Verified
Delaware State AGbd_e01aeff7b3ae70e72025-02-03Verified
Illinois State AGbd_5688b7f798a8d9062025-02-01 · +2dCandidate
HHS OCRbd_1423e93c664283e02024-10-04 · +122dVerified

Name: Bayhealth Medical Center
norm: bayhealth medical center
Domain: bayhealth.org

Name: Bayhealth Medical Center
norm: bayhealth medical center
Domain: bayhealth.org
Industry: Healthcarellm

Discovered: Jul 31, 2024
Breach occurred: Jul 27, 2024 – Jul 31, 2024
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 3, 2025
Affected individuals: 257state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1119 Automated Collection
Threat actor: External
Regulator citations: Notified federal law enforcementProviding written notice to relevant state and federal regulatorsNotifying the U.S. Department of Health and Human Services
Initial access: exploit_public_facing

During the incident: Launched an investigation, with the assistance of forensic specialists
Notified federal law enforcement
Providing access to credit monitoring services for twelve (12) months, through IDX
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this incident to relevant state and federal regulators
Notifying the U.S. Department of Health and Human Services and prominent media pursuant to the Health Insurance Portability and Accountability Act (HIPAA)
Changes made: Working to implement additional safeguards and training to its employees
Reviewing and enhancing its policies and procedures to reduce the risk of similar incidents recurring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 weeks(187 days from discovery to filing)
Compliance flags: ME AG >90d · 187dME resident >60d · 187dLeak >90d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jul 31, 2024
→ Filed with AG: Feb 3, 2025
187d 90 days ME AG >90d
Maine
Discovered: Jul 31, 2024
→ Notified: Feb 3, 2025
187d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jul 31, 2024 → Filed with AG: Feb 3, 2025	187d	90 days	ME AG >90d
Maine	Discovered: Jul 31, 2024 → Notified: Feb 3, 2025	187d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 9 states

View merged incident ↗

HHS OCROct 4 · first

Illinois State AG+120d

Montana State AG+122d

Nebraska State AG+122d

New Hampshire State AG+122d

California State AG+122d

Vermont State AG+122d

Massachusetts State AG+122d

Delaware State AG+122d

Maine State AG+122d · this page

Pattern: first filing Oct 4 (DE), last Feb 3 (ME) — a 122-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/74b7af46-29ca-41ce-8eec-31a4f0bc404f.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 3, 2025
Raw hash: 0cf0093846a5d3fa3811bee30501bfef7390e1447926fa016c501c903bfecd82

Linked disclosures

Ransomware claims (1)

Regulatory filings (9) · sorted by filing gap

Reporting entityBayhealth Medical Center

Victim entityBayhealth Medical Center

Incidentdiscovered Jul 31, 2024

Stated responseLaunched an investigation, with the assistance of forensic specialists

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov