MalwareHealthcareHealthcareRansomwareData EncryptedTargetedIdentity (basic)Government IDFinancial accountHealth (basic)PHIMediumContained

Maternal & Family Health Services

bd_4b5591fe1864b5b7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 4, 2022

Filed

Jan 10, 2023

To disclose

40 weeks

Affected

43state residents only

Linked

4 filings

Confidence

63%

Full breach record for Maternal & Family Health Services →

Maternal & Family Health Services, Inc. disclosed a ransomware incident occurring between August 21, 2021, and April 4, 2022. The breach compromised personal information including names, SSNs, driver's licenses, financial account data, and medical/health insurance information. The organization engaged forensic investigators and offered credit monitoring services to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 226 days

discovery → filing · 40 weeks / 281 days

Aug 21, 2021

Begins

Apr 4, 2022

Discovered

Jan 10, 2023

Filed

vs. sector median

+28 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

New Hampshire State AGbd_6d4cfb317daf08cd2023-01-17 · +7dVerified
Delaware State AGbd_04525bd194c7c5a32023-01-03 · +7dCandidate
Maine State AGbd_cf0932fca26647762023-07-29 · +200dVerified

Name: Maternal & Family Health Services
norm: maternal family health

Name: Maternal & Family Health Services
norm: maternal family health
Industry: Healthcarellm

Discovered: Apr 4, 2022
Breach occurred: Aug 21, 2021 – Apr 4, 2022
Undetected for: 226 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 3, 2023
Affected individuals: 43state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial

During the incident: Launched an investigation
Engaged a national cybersecurity firm to assist in assessing the scope of the incident
Took steps to mitigate the potential impact to our community
Working with cybersecurity counsel to determine the actions to take in response to the incident
Continue to investigate and closely monitor the situation
Taking steps to strengthen our security posture to prevent a similar event from occurring again in the future
Arranged for you to enroll in a complementary, credit monitoring and identity theft protection services through IDX
Changes made: Taking steps to strengthen our security posture to prevent a similar event from occurring again in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 40 weeks(281 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Delaware State AGJan 3 · first

Montana State AG+7d · this page

New Hampshire State AG+14d

Maine State AG+207d

Pattern: first filing Jan 3 (DE), last Jul 29 (ME) — a 207-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-794.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 10, 2023
Raw hash: a143944b7b621b5a65e34d9247be18aa9026f1685e7845b9a45d3aa255c0dfac

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMaternal & Family Health Services

Victim entityMaternal & Family Health Services

Incidentdiscovered Apr 4, 2022

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov