MisuseHealthcareHealthcarePrivilege AbuseData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedDelayed DiscoveryIdentity (basic)Government IDPHIHealth (basic)MediumActive

University Hospital

bd_4cd2c8e1a8e6489f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 24, 2021

Filed

Nov 3, 2021

To disclose

10 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

65%

Full breach record for University Hospital →3 incidents on file

University Hospital notified the NH Attorney General of an insider threat incident involving a former employee who accessed and provided patient data (PII, PHI, SSN) to unauthorized parties between Jan 1, 2016 and Dec 31, 2017. The breach was discovered on Aug 24, 2021. Notifications were mailed on Oct 8, 2021, offering credit monitoring. A criminal investigation is ongoing.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2062 days

discovery → filing · 10 weeks / 71 days

Jan 1, 2016

Begins

Aug 24, 2021

Discovered

Nov 3, 2021

Filed

vs. sector median

1 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_9f18f865dfda08c62021-11-03Verified
Maine State AGbd_af958d2b447a902b2021-11-03Verified
HHS OCRbd_bcd7cd6504f4a8e62021-11-05 · +2dVerified
Montana State AGbd_0af23879220bd9422021-10-08 · +26dVerified

Show 1 more filing ↓up to 26d gap

HHS OCRbd_a5cf29a0301bcdcb2021-10-08 · +26dVerified

Name: University Hospital
norm: university hospital
Domain: uhnj.org

Name: University Hospital
norm: university hospital
Domain: uhnj.org
Industry: Healthcarellm

Discovered: Aug 24, 2021
Breach occurred: Jan 1, 2016 – Dec 31, 2017
Undetected for: 2,062 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 8, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDPHIHealth (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: Notified New Hampshire Attorney General
Initial access: insider_action

During the incident: Mailed letters to affected patients
Offered complimentary one-year credit monitoring and identity protection membership
Established a dedicated incident response line
Reviewed internal policies, procedures and staff training pertaining to the privacy of patient information
Changes made: Reviewed internal policies, procedures and staff training pertaining to the privacy of patient information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(71 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Montana State AGOct 8 · first

HHS OCROct 8 · first

Massachusetts State AG+26d

Maine State AG+26d

New Hampshire State AG+26d · this page

HHS OCR+28d

Pattern: first filing Oct 8 (MT), last Nov 5 (NJ) — a 28-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/university-hospital-20211103.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 3, 2021
Raw hash: 4dceda5d0988f4b51500c7f6f941782044db9a8351b9c72e0467b23ba206f73c

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityUniversity Hospital

Victim entityUniversity Hospital

Incidentdiscovered Aug 24, 2021

Stated responseMailed letters to affected patients

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov