HackingHealthcareHealthcareSupply Chain (3P Vendor)Customer Data InvolvedPIIIdentity (basic)LowContained

CRG Lynwood, LLC

bd_605c836d0f7905f0 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 1, 2022

Filed

Jun 10, 2024

To disclose

22 months

Affected

Not disclosed

Linked

3 filings

Confidence

66%

Full breach record for CRG Lynwood, LLC →

CRG Lynwood, LLC d/b/a Lynwood Manor notified the NH AG of a cybersecurity incident involving its third-party administrator, Excelerate Healthcare Services (EHS). The incident occurred in July 2021, but Lynwood did not learn of the potential impact on patient information until September 2022. The breach exposed PII, including names and addresses. Lynwood engaged forensic investigators, deployed monitoring tools, and offered credit monitoring services to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 427 days

discovery → filing · 22 months / 648 days

Jul 1, 2021

Begins

Sep 1, 2022

Discovered

Jun 10, 2024

Filed

vs. sector median

+80 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_807a36cceac76c0c2024-06-10Verified
HHS OCRbd_9e946490177e45662024-06-10Verified

Name: CRG Lynwood, LLC
norm: crg lynwood

Name: CRG Lynwood, LLC
norm: crg lynwood
Also named: CRG Lynwood, LLCdba oflegal entity
Lynwood Manordba oftrade name
Industry: Healthcarellm

Discovered: Sep 1, 2022
Breach occurred: Jul 1, 2021
Undetected for: 427 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 7, 2024
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: Partner
Regulator citations: Notified New Hampshire Attorney General
Initial access: supply_chain

During the incident: Engaged a third-party vendor to analyze the data
Engaged a third-party notice vendor to assist with the mailings, call center, and provide identity theft protection services
Retained a leading forensic investigation firm who assisted in conducting an investigation and confirming the security of our network environment
Deployed additional monitoring tools
Enhance the security of our systems
Providing access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score/Cyber Monitoring services at no charge
Providing proactive fraud assistance
Changes made: Deployed additional monitoring tools
Enhance the security of our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 months(648 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Maine State AGJun 10 · first

HHS OCRJun 10 · first

New Hampshire State AGJun 10 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/crg-lynwood-manor-20240610.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 10, 2024
Raw hash: 41c182c51ff72f8a8bba93daa20e4cb8d6444d8f33c331a85ce6e4f0b946f729

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCRG Lynwood, LLC

Victim entityCRG Lynwood, LLC

Incidentdiscovered Sep 1, 2022

Stated responseEngaged a third-party vendor to analyze the data

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov