MalwareHealthcareHealthcareRansomwareStolen CredentialsRansom DemandedData EncryptedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountFinancial credentialsPHIHealth (basic)CredentialsCriticalContained

Wayne Memorial Hospital

bd_4b1cd5f26ef29daa · schema v1 · pii pii-v1

Severity

Critical

Discovered

Jun 3, 2024

Filed

Sep 7, 2025

To disclose

15 months

Affected · nationwide

163,44034 in this filing

Linked

11 filings

Confidence

66%

Full breach record for Wayne Memorial Hospital →2 incidents on file

Wayne Memorial Hospital experienced a ransomware event between May 30 and June 3, 2024. An unauthorized actor gained access to the network, encrypted data, and left a ransom note. The incident affected 163,440 individuals nationwide, including 34 Maine residents. Compromised data included names, SSNs, driver's licenses, financial account numbers, PHI, and credentials. WMH engaged forensic investigators, reset passwords, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jun 3, 2024 → Filed with AG Sep 7, 2025461d ✗ ME AG >90d15 months discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 4 days

discovery → filing · 15 months / 461 days

May 30, 2024

Begins

Jun 3, 2024

Discovered

Sep 7, 2025

Filed

vs. sector median

+55 wks slower

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitemontibd_b9a1b20ea9c4502f2024-06-30 · +433dVerified
Leak Sitemontibd_ead7e5cf61e941172024-06-03 · +461dVerified

Regulatory filings (8) · sorted by filing gap

Massachusetts State AGbd_8d43056b8b431a352025-09-07Verified
Vermont State AGbd_e1539c0ea8da55742025-09-07Verified
Montana State AGbd_fb6dd2f52bc66a392025-09-07Verified
New Hampshire State AGbd_4a3a5b5a92d6120f2025-09-08 · +1dVerified

Show 4 more filings ↓up to 401d gap

Texas State AGbd_5c0d27e2856b33002025-09-09 · +2dVerified
Nebraska State AGbd_a18fbae130892d282025-08-27 · +11dVerified
Indiana State AGbd_325db4432f75dfd12025-08-02 · +36dVerified
HHS OCRbd_a42c696e8556d0362024-08-02 · +401dVerified

Name: Wilson Elser Moskowitz Edelman and Dicker LLP
norm: wilson elser
Domain: wmh.org

Name: Wayne Memorial Hospital
norm: wayne memorial hospital
Domain: wmh.org
Industry: Healthcarellm

Discovered: Jun 3, 2024
Breach occurred: May 30, 2024 – Jun 3, 2024
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 27, 2025
Affected individuals: 163,440state + nationwide
Data types: Identity (basic)Government IDFinancial accountFinancial credentialsPHIHealth (basic)Credentials
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Filed notice with Maine Office of the Attorney General
Initial access: valid_credentials

During the incident: Disconnected access to its network and took certain systems offline
Restored its network from backups
Engaged legal counsel and cybersecurity professionals
Conducted a forensic investigation
Added new intrusion detection and response tools
Reset all passwords
Made additional enhancements to WMH’s network security
Published a public notice of this event on its website
Published a media notice with the Press Sentinel in Jesup, Georgia
Mailed individual notification letters
Offered complimentary credit monitoring and identity theft protection services
Changes made: Added new intrusion detection and response tools
Reset all passwords
Made additional enhancements to WMH’s network security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 months(461 days from discovery to filing)
Compliance flags: ME AG >90d · 461dME resident >180d · 450d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jun 3, 2024
→ Filed with AG: Sep 7, 2025
461d 90 days ME AG >90d
Maine
Discovered: Jun 3, 2024
→ Notified: Aug 27, 2025
450d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jun 3, 2024 → Filed with AG: Sep 7, 2025	461d	90 days	ME AG >90d
Maine	Discovered: Jun 3, 2024 → Notified: Aug 27, 2025	450d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

HHS OCRAug 2 · first

Indiana State AG+365d

Nebraska State AG+390d

Massachusetts State AG+401d

Vermont State AG+401d

Montana State AG+401d

Maine State AG+401d · this page

New Hampshire State AG+402d

Texas State AG+403d

Pattern: first filing Aug 2 (GA), last Sep 9 (TX) — a 403-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/a180a42c-3998-4208-a65a-aa095d7166fb.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 7, 2025
Raw hash: b94e50db8f5c6a0320ecdd4992f7ec2fc762cba6ef8deb0e5af43de8553c99d7

Linked disclosures

Ransomware claims (2)

Regulatory filings (8) · sorted by filing gap

Reporting entityWilson Elser Moskowitz Edelman and Dicker LLP

Victim entityWayne Memorial Hospital

Incidentdiscovered Jun 3, 2024

Stated responseDisconnected access to its network and took certain systems offline

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov