HackingHealthcareHealthcareStolen CredentialsData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedGovernment IDIdentity (basic)Financial accountMediumContained

Milford Regional Medical Center

bd_5ea4998ee7c861fe · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 20, 2020

Filed

Jun 26, 2020

To disclose

—

Affected

16state residents only

Linked

2 filings

Confidence

66%

Full breach record for Milford Regional Medical Center →2 incidents on file

Milford Regional Medical Center (MRMC) notified the New Hampshire Attorney General on June 26, 2020, of a data breach involving its third-party vendor, PaperlessPay Corporation. An unauthorized individual accessed PaperlessPay's SQL server on February 18, 2020, potentially exposing current and former employees' names, Social Security numbers, and bank account details. MRMC identified 16 potentially impacted New Hampshire residents. MRMC offered one year of complimentary identity monitoring and transitioned to an in-house payroll solution.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 31 days

discovery → filing · 14 weeks / 98 days

Feb 18, 2020

Begins

Mar 20, 2020

Discovered

Jun 26, 2020

Filed

This filing is one of 2 about the same incident.View merged incident

Part of PaperlessPay Corporation supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_90361dbad17e8a982020-06-26Verified

Name: Milford Regional Medical Center
norm: milford regional medical center

Name: Milford Regional Medical Center
norm: milford regional medical center
Industry: Healthcarellm

Discovered: Mar 20, 2020
Breach occurred: Feb 18, 2020
Undetected for: 31 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 26, 2020
Affected individuals: 16state-resident count only
Data types: Government IDIdentity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney GeneralCooperated with DHS and FBI investigation
Initial access: valid_credentials

During the incident: Engaged forensic investigation firm (Ankura)
Notified law enforcement (DHS, FBI)
Shut down web server and SQL server
Rebuilt domain controller, web server, and SQL server
Restored database files from backups
Assigned new IP addresses to servers
Changed all passwords for users and administrators
Implemented password change requirement for first login
Disabled remote access capabilities to new servers
Installed endpoint detection and response (EDR) application (Carbon Black)
Changes made: Transitioned to an in-house solution for paystub and W2 services
Rebuilt network infrastructure (domain controller, web server, SQL server)
Implemented multi-factor authentication / password reset policies
Disabled remote access to web and SQL servers
Deployed endpoint detection and response (EDR) solution
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGJun 26 · first

New Hampshire State AGJun 26 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/milford-regional-medical-20200626.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 26, 2020
Raw hash: b0806e8f546b31ec47de784acaeaffc2fb1bd68b63f377ec519823aa923d091c

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMilford Regional Medical Center

Victim entityMilford Regional Medical Center

Incidentdiscovered Mar 20, 2020

Stated responseEngaged forensic investigation firm (Ankura)

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov