MalwareHealthcareHealthcareRansomwareData EncryptedTargetedPIIIdentity (basic)PHIHealth (basic)LowContained

Colonial Behavioral Health

bd_5b862a99b1ba176c · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 4, 2024

Filed

Dec 2, 2024

To disclose

8 weeks

Affected

1state residents only

Linked

4 filings

Confidence

66%

Full breach record for Colonial Behavioral Health →

Colonial Behavioral Health (CBH) disclosed a ransomware incident discovered on October 4, 2024, with unauthorized access beginning around May 17, 2024. The incident impacted at least one New Hampshire resident, involving access to PII and PHI. CBH engaged Kroll for identity monitoring and notified law enforcement including the FBI and CISA.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d8 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 140 days

discovery → filing · 8 weeks / 59 days

May 17, 2024

Begins

Oct 4, 2024

Discovered

Dec 2, 2024

Filed

vs. sector median

4 wks faster

This filing is one of 4 about the same incident.View merged incident

A leak claim by qilin about this victim predates this filing by 186 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteqilinbd_487ddd05edc3459c2024-05-30 · +186dVerified by operator

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_593368fddc814c5f2024-11-27 · +5dVerified by operator
HHS OCRbd_7053994b55b7f5612024-11-27 · +5dVerified

Name: Woods Rogers Vandeventer Black, PLC
norm: woods rogers vandeventer black

Name: Colonial Behavioral Health
norm: colonial behavioral health
Domain: colonialbh.org
Industry: Healthcarellm

Discovered: Oct 4, 2024
Breach occurred: May 17, 2024 – Oct 4, 2024
Undetected for: 140 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 27, 2024
Affected individuals: 1state-resident count only
Data types: PIIIdentity (basic)PHIHealth (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified state and federal law enforcement, including the FBI’s Cyber Crimes Division, the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA), and the Cyber Fusion Center of the Virginia State Police
Initial access: valid_credentials

During the incident: Notified state and federal law enforcement, including the FBI’s Cyber Crimes Division, the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA), and the Cyber Fusion Center of the Virginia State Police
Engaged outside cybersecurity experts to assist and investigate this event
Secured the services of Kroll to provide complimentary identity monitoring services
Took steps to stop the ransomware
Changes made: Continues to evaluate additional actions to strengthen network security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGNov 27 · first

HHS OCRNov 27 · first

New Hampshire State AG+5d · this page

Pattern: first filing Nov 27 (MA), last Dec 2 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/colonial-behavioral-health-20241202.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 2, 2024
Raw hash: f340868bfc9ab599c1e30fa92b26a3012be45d1c04bf4868fd89787714895bf5

Linked disclosures

Ransomware claims (1)

Regulatory filings (2) · sorted by filing gap

Reporting entityWoods Rogers Vandeventer Black, PLC

Victim entityColonial Behavioral Health

Incidentdiscovered Oct 4, 2024

Stated responseNotified state and federal law enforcement, including the FBI’s Cyber Crimes Division, the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA), and the Cyber Fusion Center of the Virginia State Police

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov