PhysicalHealthcareHealthcareTheftCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Boston Children's Hospital

bd_567ba89f82103335 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 12, 2008

Filed

Feb 12, 2009

To disclose

13 weeks

Affected

4state residents only

Confidence

64%

Full breach record for Boston Children's Hospital →9 incidents on file

Children's Hospital Boston notified NH AG of a stolen, unencrypted laptop affecting 4 NH residents. Theft occurred Nov 11, 2008; discovered Nov 12, 2008. Data included names, SSNs, and insurance subscriber numbers. No evidence of fraud. Remediation included encryption, training, and credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 13 weeks / 92 days

Nov 11, 2008

Begins

Nov 12, 2008

Discovered

Feb 12, 2009

Filed

vs. sector median

+1 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed4 affectedView incident

Name: Boston Children's Hospital
norm: boston children s hospital
Domain: childrenshospital.org

Name: Boston Children's Hospital
norm: boston children s hospital
Domain: childrenshospital.org
Industry: Healthcarellm

Discovered: Nov 12, 2008
Breach occurred: Nov 11, 2008
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Feb 12, 2009
Affected individuals: 4state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Regulator citations: Notified New Hampshire Office of Attorney General

During the incident: A police report was filed with the Boston Police Department
Offering 2 years of credit monitoring services to individuals whose social security number was involved
Ensured that all of its remaining laptops are encrypted
Issuing reminder notices to other departments about the policy
Providing reinforcement training for the department to reinforce data security policies
Changes made: Ensured that all of its remaining laptops are encrypted
Providing reinforcement training for the department to reinforce data security policies
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(92 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/childrens-hospital-20090212.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 12, 2009
Raw hash: f305ba71b5935070fd2ace8086608f277ca63ee907f94f1c9168a09620ff2ef0

Reporting entityBoston Children's Hospital

Victim entityBoston Children's Hospital

Incidentdiscovered Nov 12, 2008

Stated responseA police report was filed with the Boston Police Department

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov