MalwareHealthcareHealthcareRansomwareData EncryptedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Upper Connecticut Valley Hospital

bd_49425447fb28aa47 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 7, 2016

Filed

Dec 23, 2016

To disclose

11 weeks

Affected

2state residents only

Confidence

66%

Full breach record for Upper Connecticut Valley Hospital →

Upper Connecticut Valley Hospital notified NH AG of a security breach affecting 2 residents. A vendor's computer was infected with malware on Sept 23, 2016, discovered Oct 7. Personal info (names, SSNs, DOBs) may have been accessed. Notifications sent Nov 21. Vendor enhanced antivirus and provided training.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 14 days

discovery → filing · 11 weeks / 77 days

Sep 23, 2016

Begins

Oct 7, 2016

Discovered

Dec 23, 2016

Filed

vs. sector median

on median

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Name: Upper Connecticut Valley Hospital
norm: upper connecticut valley hospital

Name: Upper Connecticut Valley Hospital
norm: upper connecticut valley hospital
Industry: Healthcarellm

Discovered: Oct 7, 2016
Breach occurred: Sep 23, 2016
Undetected for: 14 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 21, 2016
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Initial access: external_remote_services

During the incident: Removed the computer from the network
Unshared the affected network drive from all network computers
Mailed notification letters to the two affected patients
Changes made: Implemented stronger protections in anti-virus software
Providing information and training to employees on preventing this type of breach
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(77 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/upper-connecticut-valley-hospital-20161223.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 23, 2016
Raw hash: be3d3d146c4bf72811a8dfc24ed4856309f111a966f8bc97596c8c2d1b136b7d

Reporting entityUpper Connecticut Valley Hospital

Victim entityUpper Connecticut Valley Hospital

Incidentdiscovered Oct 7, 2016

Stated responseRemoved the computer from the network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov