Social EngineeringPhishingBECData ExfiltratedCustomer Data InvolvedRansom DemandedIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICFINANCIAL_ACCOUNTMediumContained
Monongalia Health System, Inc.
bd_497fcc4b640582da · schema v1 · pii pii-v1
Full breach record for Monongalia Health System, Inc. →Monongalia Health System, Inc. notified the New Hampshire Attorney General of a phishing incident involving unauthorized access to email accounts between May 10 and August 15, 2021. The attack, discovered in July 2021, was a Business Email Compromise (BEC) scheme attempting fraudulent wire transfers. Patient data (names, MRNs, SSNs, health info) may have been accessed. Approximately 50 individuals were affected, including 12 NH residents. Mon Health secured accounts, notified law enforcement, engaged forensic investigators, and offered credit monitoring.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_181d983b91394023HHS OCRfiled 2021-12-21Candidate
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/monongalia-health-system-20211221.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 21, 2021
- Raw hash
- 10241a33968abce827367bba97f9da0e3463a6e549c291ea08034f93f53b5e52
Reporting entity
- Name
- Monongalia Health System, Inc.norm: monongalia health system
Victim entity
- Name
- Monongalia Health System, Inc.norm: monongalia health system
Incident
- Discovered
- Jul 28, 2021
- Materiality determined
- —
- Notification sent
- Dec 21, 2021
- Affected individuals
- 50
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICFINANCIAL_ACCOUNT
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified New Hampshire Attorney General
- Initial access
- phishing_link
Compliance
- Time to disclose
- 21 weeks(146 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.