HackingHealthcareHealthcareDelayed DiscoveryIdentity (basic)Government IDFinancial accountHealth (basic)PHIMediumContained

Mount Desert Island Hospital

bd_529604a4efb3f8f5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 4, 2023

Filed

Jun 30, 2023

To disclose

8 weeks

Affected

Not disclosed

Linked

11 filings

Confidence

66%

Full breach record for Mount Desert Island Hospital →

Mount Desert Island Hospital, Inc. notified consumers of a data breach where unauthorized access occurred between April 28 and May 7, 2023. The incident exposed PHI, SSNs, driver's licenses, and financial data. The hospital engaged third-party specialists, notified law enforcement, and offered credit monitoring services.

J jump to incidentP pin to compareR raw source

Vermont clock⏱ VT AG >14 bday8 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 6 days

discovery → filing · 8 weeks / 57 days

Apr 28, 2023

Begins

May 4, 2023

Discovered

Jun 21, 2023

Scope determined

Jun 30, 2023

Filed

vs. sector median

4 wks faster

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitesnatchbd_06a87387a5341b482023-06-05 · +25dVerified by operator
Leak Sitedispossessorbd_b8dca3cb5dc60ff42023-06-03 · +27dVerified by operator

Regulatory filings (8) · sorted by filing gap

HHS OCRbd_5f803381a2b19c3e2023-06-30Verified by operator
New Hampshire State AGbd_044b7cb6e8c5de742023-07-14 · +14dVerified
Massachusetts State AGbd_078a57c00ca2db1d2023-07-14 · +14dVerified
Montana State AGbd_d67d09f2ab8c5b202023-07-14 · +14dVerified

Show 4 more filings ↓up to 81d gap

Maine State AGbd_437493e24886ba992023-07-17 · +17dVerified
Indiana State AGbd_26f8fb34f618424e2023-06-05 · +25dCandidate
New Hampshire State AGbd_113f749ab88f2f6b2023-09-19 · +81dVerified
Maine State AGbd_22158dc4a26fa3ca2023-09-19 · +81dVerified

Name: Mount Desert Island Hospital
norm: mount desert island hospital
Domain: mdihospital.org

Name: Mount Desert Island Hospital
norm: mount desert island hospital
Domain: mdihospital.org
Industry: Healthcarellm

Discovered: May 4, 2023
Breach occurred: Apr 28, 2023 – May 7, 2023
Undetected for: 6 daysoccurrence → discovery
Materiality determined: Jun 21, 2023
Notification sent: Jun 30, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Worked with third-party specialists to investigate
Re-secured network
Implemented additional security precautions
Notified law enforcement
Offering 12/24 months of complimentary credit monitoring and identity protection services
Changes made: Reviewing policies and procedures related to data protection
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: VT AG >14 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 6 states

View merged incident ↗

Indiana State AGJun 5 · first

HHS OCR+25d

Vermont State AG+25d · this page

New Hampshire State AG+39d

Massachusetts State AG+39d

Montana State AG+39d

Maine State AG+42d

New Hampshire State AG+106d

Maine State AG+106d

Pattern: first filing Jun 5 (IN), last Sep 19 (ME) — a 106-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-06-30-mount-desert-island-hospital-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 30, 2023
Raw hash: be6b31f094f8a9a268b65518a9d250bb45261ce794d9c06c27bebe721421863d

Linked disclosures

Ransomware claims (2)

Regulatory filings (8) · sorted by filing gap

Reporting entityMount Desert Island Hospital

Victim entityMount Desert Island Hospital

Incidentdiscovered May 4, 2023

Stated responseWorked with third-party specialists to investigate

ComplianceVT AG >14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov