HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedPIIIdentity (basic)LowContained

McAlester Regional Health Center

bd_53dcc179f3911434 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 8, 2023

Filed

Nov 21, 2023

To disclose

28 weeks

Affected

2state residents only

Linked

7 filings

Confidence

67%

Full breach record for McAlester Regional Health Center →

McAlester Regional Health Center notified NH DOJ of a May 8, 2023 incident involving unauthorized access to systems. Two NH residents affected. PII exposed. Vendor forensic review completed Oct 23, 2023. Notifications sent Nov 15, 2023. Remediation included firewall tightening, password resets, and credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d28 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 28 weeks / 197 days

May 8, 2023

Discovered

Nov 21, 2023

Filed

vs. sector median

+16 wks slower

This filing is one of 7 about the same incident.View merged incident

A leak claim by karakurt about this victim predates this filing by 116 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitekarakurtbd_72ed3abe8b59b82d2023-07-28 · +116dVerified

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_00762f4dda0869482023-11-15 · +6dVerified by operator
Vermont State AGbd_6751323e8c15cad42023-11-15 · +6dVerified by operator
Montana State AGbd_bd461962ac34b82e2023-11-15 · +6dVerified by operator
Massachusetts State AGbd_f831e61cf6da1edf2023-11-15 · +6dVerified by operator

Show 1 more filing ↓up to 92d gap

HHS OCRbd_6e23414cd27637502023-08-21 · +92dCandidate

Name: McAlester Regional Health Center
norm: mcalester regional health center
Domain: mcalesterregional.com

Name: McAlester Regional Health Center
norm: mcalester regional health center
Domain: mcalesterregional.com
Industry: Healthcarellm

Discovered: May 8, 2023
Materiality determined: —
Notification sent: Nov 15, 2023
Affected individuals: 2state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Department of Justice
Initial access: valid_credentials

During the incident: Implemented its incident response protocols
Disconnected all systems
Engaged external cybersecurity experts to conduct a forensic investigation
Engaged a vendor to review the impacted data
Changes made: Tightening firewall restrictions
Rewriting, and strengthening their password policy
Initiating password changes across the organization for every account
Increasing restrictions on the sharing of files
Providing complimentary credit monitoring and identity restoration services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(197 days from discovery to filing)
Compliance flags: Leak >90d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

HHS OCRAug 21 · first

Maine State AG+86d

Vermont State AG+86d

Montana State AG+86d

Massachusetts State AG+86d

New Hampshire State AG+92d · this page

Pattern: first filing Aug 21 (OK), last Nov 21 (NH) — a 92-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/mcalester-regional-health-center-20231121.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 21, 2023
Raw hash: ad2960f0ef926da87f0e13dadd84241112fbcb92222d917e54ee8c9522dad08d

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityMcAlester Regional Health Center

Victim entityMcAlester Regional Health Center

Incidentdiscovered May 8, 2023

Stated responseImplemented its incident response protocols

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov