HackingHealthcareGovernment IDIdentity (basic)Financial accountHighContained

SANTA BARBARA COTTAGE HOSPITAL FOUNDATION

bd_591558d47bace9c6 · schema v1 · pii pii-v1

Severity

High

Discovered

May 28, 2026

Filed

Jul 2, 2026

To disclose

5 weeks

Affected

1,792state residents only

Linked

2 filings

Confidence

66%

Full breach record for SANTA BARBARA COTTAGE HOSPITAL FOUNDATION →2 incidents on file

Cottage Hospital submitted a supplemental incident notification to the New Hampshire Attorney General regarding unauthorized access to its computer network. The breach affected 1,792 New Hampshire residents, exposing names, SSNs, driver's license numbers, and financial account data. The incident occurred between February 6, 2026, and July 2, 2026, with discovery on May 28, 2026. The hospital provided one year of credit monitoring and established a call center for affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 111 days

discovery → filing · 5 weeks / 35 days

Feb 6, 2026

Begins

May 28, 2026

Discovered

Jul 2, 2026

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Vermont State AGbd_77ec9d08edcdd2e72026-07-02Candidate

Name: SANTA BARBARA COTTAGE HOSPITAL FOUNDATION
norm: santa barbara cottage hospital

Name: SANTA BARBARA COTTAGE HOSPITAL FOUNDATION
norm: santa barbara cottage hospital

Discovered: May 28, 2026
Breach occurred: Feb 6, 2026 – Jul 2, 2026
Undetected for: 111 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 6, 2026
Affected individuals: 1,792state-resident count only
Data types: Government IDIdentity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1119 Automated Collection
Threat actor: External
Regulator citations: Supplemental Incident Notification to Attorney General John Formella

During the incident: Completed its investigation of an incident that involved unauthorized access to its computer network and some of Cottage Hospital’s files
Mailed notification letters via U.S. First-Class mail to a total of 1,792 New Hampshire residents
Offering one year of complimentary credit monitoring, fraud consultation, and identity theft restoration services through Experian
Established a toll-free call center to answer any questions individuals may have
Took immediate steps to identify and contain this incident
Changes made: Continue to implement and evaluate enhanced safeguards and security measures to further protect Cottage Hospital’s systems and reduce the likelihood of a similar future event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Vermont State AGJul 2 · first

New Hampshire State AGJul 2 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cottage-hospital-20260702.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 2, 2026
Raw hash: fe90d2ecaa81341fc4463f7b85e0468f1c734b2b103671fb003da57eaa3fbf73

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entitySANTA BARBARA COTTAGE HOSPITAL FOUNDATION

Victim entitySANTA BARBARA COTTAGE HOSPITAL FOUNDATION

Incidentdiscovered May 28, 2026

Stated responseCompleted its investigation of an incident that involved unauthorized access to its computer network and some of Cottage Hospital’s files

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov