HackingStolen CredentialsCustomer Data InvolvedData ExfiltratedPIIPHIIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICMediumContained
Bone & Joint Clinic, S.C.
bd_49594d62d05a0739 · schema v1 · pii pii-v1
Full breach record for Bone & Joint Clinic, S.C. →Bone & Joint Clinic S.C. notified the New Hampshire Attorney General of a data security incident discovered on January 16, 2023. Unauthorized access to administrative and medical files potentially exposed patient PII, PHI, and SSNs. Seven New Hampshire residents were affected. The clinic engaged cybersecurity experts, notified the FBI, and offered credit monitoring and identity protection services.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_7531a824bea14cf7Maine State AGfiled 2023-03-20Candidate
- bd_8d202bdbb06effceMontana State AGfiled 2023-03-14(6d gap)Candidate
- bd_786ca69621261d8bHHS OCRfiled 2023-03-13(7d gap)Candidate
- bd_abfe4c8408c67439Vermont State AGfiled 2023-03-07(13d gap)Candidate
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/bone-joint-clinic-20230320.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 20, 2023
- Raw hash
- b23a10b60d38078d4c02b66543ea7b94280af8292023c826f9967f823403b01d
Reporting entity
- Name
- Bone & Joint Clinic, S.C.norm: bone joint clinic sc
Victim entity
- Name
- Bone & Joint Clinic, S.C.norm: bone joint clinic sc
Incident
- Discovered
- Jan 16, 2023
- Materiality determined
- Jan 27, 2023
- Notification sent
- Mar 7, 2023
- Affected individuals
- 7
- Data types
- PIIPHIIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1119 Automated Collection
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified the Federal Bureau of Investigation
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 9 weeks(63 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.