HackingHealthcareHealthcareStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedTargetedPHIIdentity (basic)PIILowActive

The Chattanooga Heart Institute

bd_5659cfb7865d2e45 · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 17, 2023

Filed

Mar 28, 2024

To disclose

49 weeks

Affected

Not disclosed

Linked

14 filings

Confidence

65%

Full breach record for The Chattanooga Heart Institute →2 incidents on file

The Chattanooga Heart Institute reported a cybersecurity attack where an unauthorized third party gained access to its network between March 8-16, 2023. The Institute identified indications of the attack on April 17, 2023. Patient PHI and basic identity information were potentially accessed. The Institute notified law enforcement, HHS, and state regulators, and provided credit monitoring via Equifax to affected individuals.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d49 weeks discovery → filing

Incident timeline

undetected · 40 days

discovery → filing · 49 weeks / 346 days

Mar 8, 2023

Begins

Apr 17, 2023

Discovered

Mar 28, 2024

Filed

vs. sector median

+38 wks slower

This filing is one of 14 about the same incident.View merged incident

A leak claim by karakurt about this victim predates this filing by 310 days.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Maine State AGbd_a2267e549573aa932024-03-28Candidate
Vermont State AGbd_aa1ec43b034d96982024-03-27 · +1dVerified by operator
Maine State AGbd_4bc290ca5363ed842024-02-13 · +44dVerified by operator
Maine State AGbd_0442e5051ee137822023-10-06 · +174dVerified by operator

Show 6 more filings ↓up to 244d gap

Vermont State AGbd_41c7c1f47282b3aa2023-10-06 · +174dVerified by operator
New Hampshire State AGbd_92dcbb06b28886722023-10-06 · +174dVerified by operator
Indiana State AGbd_0abfce1eab26b5b92023-07-28 · +244dVerified
Montana State AGbd_27ff2e2d4479e8db2023-07-28 · +244dVerified by operator
Maine State AGbd_371787f6f5dc7cf62023-07-28 · +244dVerified by operator
New Hampshire State AGbd_98840e756fa810612023-07-28 · +244dVerified by operator

Showing first 10 of 13 linked disclosures.

Name: The Chattanooga Heart Institute
norm: the chattanooga heart institute

Name: The Chattanooga Heart Institute
norm: the chattanooga heart institute
Industry: Healthcarellm

Discovered: Apr 17, 2023
Breach occurred: Mar 8, 2023 – Mar 16, 2023
Undetected for: 40 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 28, 2023
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)PII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: notified federal law enforcementproviding written notice of this incident to relevant state regulatorsnotified the U.S. Department of Health and Human Services pursuant to the Health Insurance Portability and Accountability Act (HIPAA)
Initial access: valid_credentials

During the incident: Moved quickly to investigate and respond to the incident
Assess the security of The Chattanooga Heart Institute systems
Identify potentially affected individuals
Notified federal law enforcement regarding the event
Took quick action to protect its systems
Contain the incident
Begin an investigation
Maintain continuity of care
Secured the services of Equifax to provide identity monitoring
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Advising individuals to be vigilant and review health care statements
Providing individuals with information on how to place a fraud alert and security freeze on one’s credit file
Providing written notice of this incident to relevant state regulators
Providing written notice... to the three major credit reporting agencies
Notified the U.S. Department of Health and Human Services pursuant to the Health Insurance Portability and Accountability Act (HIPAA)
Changes made: Systems were returned to the network with additional security and monitoring tools
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 49 weeks(346 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 5 states

View merged incident ↗

Indiana State AGJul 28 · first

Montana State AGJul 28 · first

Maine State AGJul 28 · first

New Hampshire State AGJul 28 · first

Maine State AG+70d

Vermont State AG+70d

New Hampshire State AG+70d

Maine State AG+200d

Vermont State AG+243d

Maine State AG+244d

New Hampshire State AG+244d · this page

Pattern: first filing Jul 28 (IN), last Mar 28 (NH) — a 244-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 13 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/chattanooga-heart-institute-20240328.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 28, 2024
Raw hash: cf1c8f438d006b278038ba6cd71f9ff1a7ec57efc35db813a47713efb8c11644

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityThe Chattanooga Heart Institute

Victim entityThe Chattanooga Heart Institute

Incidentdiscovered Apr 17, 2023

Stated responseMoved quickly to investigate and respond to the incident

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov