HackingHealthcareTechnologyHealthcareStolen CredentialsCapture Stored DataData ExfiltratedTargetedPIIIdentity (basic)Government IDMediumContained

Behavioral Health Group

bd_54e0df5dfec8eeeb · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 22, 2022

Filed

Jul 27, 2022

To disclose

5 weeks

Affected

8state residents only

Linked

3 filings

Confidence

66%

BHG Holdings, LLC (d/b/a Behavioral Health Group) notified Montana residents of a security incident where unauthorized access to its network occurred on December 5, 2021. The breach was discovered on June 22, 2022, following an investigation by outside cybersecurity professionals. Personal information, including names and government IDs, was accessed. The company provided 12 months of credit monitoring and implemented security improvements including MFA and enhanced monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 199 days

discovery → filing · 5 weeks / 35 days

Dec 5, 2021

Begins

Jun 22, 2022

Discovered

Jul 27, 2022

Filed

vs. sector median

7 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_f8f7db21a01517052022-07-27Verified
New Hampshire State AGbd_6906ff918461399a2022-08-01 · +5dVerified

Name: BHG Holdings, LLC
norm: bhg holdings

Name: Behavioral Health Group
norm: behavioral health group
Also named: BHG Holdings, LLCoperating subsidiary ofholding company
Industry: HealthcarellmTechnologyllm

Discovered: Jun 22, 2022
Breach occurred: Dec 5, 2021
Undetected for: 199 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 27, 2022
Affected individuals: 8state-resident count only
Data types: PIIIdentity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Contained and secured the threat
Commenced a prompt and thorough investigation
Launched an investigation in consultation with outside cybersecurity professionals
Providing 12 months of free credit monitoring and identity theft protection services through IDX
Changes made: Strengthened our network
Implemented additional security improvements recommended by third-party cyber security experts
Resetting account passwords
Strengthening our password security policies
Implementing multi-factor authentication for network access
Upgrading our endpoint detection software
Integration of a 24/7 third-party security monitoring service
Coordinating additional employee training related to network security and threat detection
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGJul 27 · first

Montana State AGJul 27 · first · this page

New Hampshire State AG+5d

Pattern: first filing Jul 27 (MA), last Aug 1 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-432.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 27, 2022
Raw hash: ee2b831f1362072ac8a99feb27fd3f33f86019d5a25a0ac89ec25f343d8d0413

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityBHG Holdings, LLC

Victim entityBehavioral Health Group

Incidentdiscovered Jun 22, 2022

Stated responseContained and secured the threat

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov