HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedPHIIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

Summit BHC West Virginia, LLC

bd_523ce67d6b7ee741 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 26, 2021

Filed

Apr 5, 2022

To disclose

23 weeks

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for Summit BHC West Virginia, LLC →2 incidents on file

Summit BHC West Virginia, LLC d/b/a Highland Hospital experienced a security incident on October 26, 2021, when an unauthorized party accessed an employee's ADP portal and altered payroll information. This triggered an alert, leading to the discovery that an unauthorized third party had logged into five employee email accounts. The incident potentially exposed PHI, PII, and financial information of patients and employees, including one New Hampshire resident. The actor attempted unsuccessful payment fraud. Highland contained the incident, reset passwords, implemented MFA, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 23 weeks / 161 days

Oct 26, 2021

Begins

Oct 26, 2021

Discovered

Apr 5, 2022

Filed

vs. sector median

+12 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_82786b324d89a3832022-04-01 · +4dVerified
Indiana State AGbd_ca4f8f28e791e8602022-03-31 · +5dVerified

Name: Summit BHC West Virginia, LLC d/b/a Highland Hospital
norm: summit bhc west virginia
Domain: highlandhosp.com

Name: Summit BHC West Virginia, LLC
norm: summit bhc west virginia
Domain: highlandhosp.com
Also named: Summit BHC West Virginia, LLCdba oflegal entity
Highland Hospitaldba oftrade name
Industry: Healthcarellm

Discovered: Oct 26, 2021
Breach occurred: Oct 26, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 31, 2022
Affected individuals: 1state-resident count only
Data types: PHIIdentity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Reported to the U.S. Department of Health and Human Services pursuant to 45 CFR §164.408Provided notice to the New Hampshire Attorney General pursuant to N.H. Rev. Stat. § 359-C:19
Initial access: valid_credentials

During the incident: Investigated with the help of outside experts
Terminated the unauthorized party’s access to the O365 System
Resetting the passwords for the compromised user accounts
Implementing multi-factor authentication for all user e-mail accounts
Implemented new threat monitoring and prevention tools
Offering one year of complimentary credit monitoring and identity protection services through Experian
Changes made: Implementing multi-factor authentication for all user e-mail accounts
Implemented new threat monitoring and prevention tools to further secure the Highland network against cyber threats
Introducing additional authentication and security training requirements for all of its employees in 2022 to counteract phishing and other social engineering techniques
Expanded corporate IT staff to increase the ability to manage the environment more securely
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(161 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGMar 31 · first

Massachusetts State AG+1d

New Hampshire State AG+5d · this page

Pattern: first filing Mar 31 (IN), last Apr 5 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/summit-bhc-west-virginia-dba-highland-hospital-20220405.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 5, 2022
Raw hash: f22bda82548b68ac43b2bdd9bc68b042dc9092ebe8b2e82293a1ecfd4a791c48

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySummit BHC West Virginia, LLC d/b/a Highland Hospital

Victim entitySummit BHC West Virginia, LLC

Incidentdiscovered Oct 26, 2021

Stated responseInvestigated with the help of outside experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov