HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedPIIPHIIdentity (basic)Health (basic)MinorMediumContained

Seacoast Mental Health Center

bd_4c67abe3f8a07d08 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 30, 2022

Filed

Apr 14, 2023

To disclose

19 weeks

Affected

426state residents only

Confidence

67%

Seacoast Mental Health Center (SMHC) detected unusual activity on an email account on November 30, 2022. A forensic investigation concluded on January 18, 2023, that two email accounts were compromised by an unauthorized actor. 426 New Hampshire residents were potentially affected. SMHC secured accounts, engaged forensics, reset credentials, and offered credit monitoring. No evidence of misuse was found.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 19 weeks / 135 days

Nov 30, 2022

Discovered

Apr 14, 2023

Filed

vs. sector median

+7 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed426 affectedView incident

Name: Seacoast Mental Health Center
norm: seacoast mental health center

Name: Seacoast Mental Health Center
norm: seacoast mental health center
Industry: Healthcarellm

Discovered: Nov 30, 2022
Materiality determined: —
Notification sent: Apr 10, 2023
Affected individuals: 426state-resident count only
Data types: PIIPHIIdentity (basic)Health (basic)Minor
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General

During the incident: Secured the compromised account
Engaged a specialized third-party cybersecurity firm to conduct a comprehensive forensic investigation
Disabled the compromised accounts
Issued new user accounts to the affected users
Changed all company passwords for all user accounts
Sent an all-agency informational email about email security for this Incident
Provided and mandated additional HIPAA and cybersecurity training
Revoked all sessions for email enabled accounts and administrator level accounts
Employed technical security policies to block all connection attempts from outside the U.S.
Changed cloud configuration to require administrator approval for new applications
Added the attachment within the malicious email to the list of blocked files within the endpoint protection solution
Upgraded endpoint protection and firewalls
Removed the malicious email from all the mailboxes via server-side
Offered twelve (12) months of complimentary credit monitoring and identity theft restoration services through Cyberscout
Changes made: Provided and mandated additional HIPAA and cybersecurity training
Employed technical security policies to block all connection attempts from outside the U.S.
Changed cloud configuration to require administrator approval for new applications
Upgraded endpoint protection and firewalls
Enhanced security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(135 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/seacoast-mental-health-center-20230414.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 14, 2023
Raw hash: 7ef75559b1ce9fc7e23790b5c69452df288f9d74f937691f3a89656808e645a1

Reporting entitySeacoast Mental Health Center

Victim entitySeacoast Mental Health Center

Incidentdiscovered Nov 30, 2022

Stated responseSecured the compromised account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov