Social EngineeringHealthcareHealthcarePhishingData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDMediumContained

Centerstone of Tennessee, Inc.

bd_50e662acc1130a18 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 14, 2022

Filed

Sep 15, 2022

To disclose

30 weeks

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for Centerstone of Tennessee, Inc. →2 incidents on file

Centerstone of Tennessee, Inc. notified the New Hampshire Attorney General of a data security incident involving one NH resident. Unauthorized access to an employee email account occurred on January 8, 2022, likely via phishing. The breach exposed names and Social Security numbers. Centerstone discovered the activity on February 14, 2022, and notified the resident on September 12, 2022. Remediation included credential resets, policy revisions, and offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 37 days

discovery → filing · 30 weeks / 213 days

Jan 8, 2022

Begins

Feb 14, 2022

Discovered

Sep 15, 2022

Filed

vs. sector median

+18 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_b9106ab9b1c0f8d32022-09-14 · +1dCandidate
HHS OCRbd_d5fb12ad38bb3a0b2022-09-12 · +3dVerified

Name: Lewis Brisbois Bisgaard & Smith, PLLC
norm: lewis brisbois bisgaard smith

Name: Centerstone of Tennessee, Inc.
norm: centerstone of tennessee
Industry: Healthcarellm

Discovered: Feb 14, 2022
Breach occurred: Jan 8, 2022
Undetected for: 37 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 12, 2022
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: Reported the incident to the Department of Health and Human Services Office for Civil Rights
Initial access: phishing_link

During the incident: Secured its email environment
Launched a thorough investigation
Undertook a comprehensive review of the full contents of the email account
Resetting credentials to all potentially affected accounts
Revising Centerstone’s mobile device and email syncing policies
Increasing its password complexity requirements
Established a toll-free call center through IDX
Offering twelve (12) months of complimentary credit and identity monitoring services
Reported the incident to the Department of Health and Human Services Office for Civil Rights
Changes made: Implemented additional safeguards to help ensure the security of its systems
Resetting credentials to all potentially affected accounts
Revising Centerstone’s mobile device and email syncing policies
Increasing its password complexity requirements
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(213 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

HHS OCRSep 12 · first

Montana State AG+2d

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/centerstone-tennessee-20220915.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 15, 2022
Raw hash: 9b43f6edca19c0da82c6c4d54fd6267268ad7ab59d56adf1a52e1ac8fc41a57a

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityLewis Brisbois Bisgaard & Smith, PLLC

Victim entityCenterstone of Tennessee, Inc.

Incidentdiscovered Feb 14, 2022

Stated responseSecured its email environment

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov