HackingHealthcareHealthcareStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)PHIMediumContained

Jackson County Hospital District

bd_59a008e361870b87 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 9, 2022

Filed

May 10, 2022

To disclose

17 weeks

Affected

15state residents only

Linked

5 filings

Confidence

66%

Full breach record for Jackson County Hospital District →2 incidents on file

Jackson County Hospital District notified NH AG of a data event affecting 15 NH residents. Unauthorized access occurred Jan 9, 2022, confirmed Jan 11. Data included PII (SSN, DOB) and PHI. Response included forensic investigation, password resets, and 12 months credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 17 weeks / 121 days

Jan 9, 2022

Begins

Jan 9, 2022

Discovered

May 10, 2022

Filed

vs. sector median

+5 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_5fe65c8c6610d6e42022-05-06 · +4dVerified
Maine State AGbd_b26438e5815922e42022-05-06 · +4dVerified
Indiana State AGbd_ed3342b2fbe626e42022-05-06 · +4dVerified
Illinois State AGbd_bd8662d52f8d31e02022-01-01 · +129dCandidate

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Jackson County Hospital District
norm: jackson county hospital district
Domain: jchd.org
Industry: Healthcarellm

Discovered: Jan 9, 2022
Breach occurred: Jan 9, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 6, 2022
Affected individuals: 15state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General Consumer Protection Bureau

During the incident: Worked with third-party cybersecurity specialists
Took steps to contain the threat quickly
Launched a full investigation
Resetting relevant account passwords
Reviewing the contents of the impacted systems
Reviewing internal systems to identify contact information
Providing access to credit monitoring services for twelve (12) months
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Implementing additional safeguards and training to its employees
Reviewing existing policies and procedures to reduce the likelihood of a similar future incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(121 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Illinois State AGJan 1 · first

Massachusetts State AG+125d

Maine State AG+125d

Indiana State AG+125d

New Hampshire State AG+129d · this page

Pattern: first filing Jan 1 (IL), last May 10 (NH) — a 129-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/jackson-hospital-20220510.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 10, 2022
Raw hash: edcc4d513d696cfec5181581d40aa0007f190cf846783c408bc9a6233945f3cf

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityJackson County Hospital District

Incidentdiscovered Jan 9, 2022

Stated responseWorked with third-party cybersecurity specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov