MalwareHealthcareHealthcareRansomwareCapture Stored DataData ExfiltratedCustomer Data InvolvedRansom DemandedPIIIdentity (basic)Government IDPHIHealth (basic)MediumContained

Upper Dublin Family Dentistry

bd_641bb2c284ab6799 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 13, 2025

Filed

Jul 21, 2025

To disclose

10 weeks

Affected

1state residents only

Linked

4 filings

Confidence

67%

Full breach record for Upper Dublin Family Dentistry →3 incidents on file

Upper Dublin Family Dentistry notified the NH Attorney General on July 21, 2025, of a ransomware incident discovered May 13, 2025. An unauthorized party encrypted data and potentially accessed patient info (names, SSNs, PHI) for one NH resident. UDFD engaged forensic investigators, improved web server infrastructure, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 weeks / 69 days

May 13, 2025

Discovered

Jul 21, 2025

Filed

vs. sector median

+1 wks slower

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_796adcd6567fd0fe2025-07-21Verified
Nebraska State AGbd_9a86c2d4313a2c852025-07-21Verified
Vermont State AGbd_a4642a3efde6fed02025-07-21Candidate

Name: Upper Dublin Family Dentistry
norm: upper dublin family dentistry

Name: Upper Dublin Family Dentistry
norm: upper dublin family dentistry
Industry: Healthcarellm

Discovered: May 13, 2025
Materiality determined: —
Notification sent: Jul 21, 2025
Affected individuals: 1state-resident count only
Data types: PIIIdentity (basic)Government IDPHIHealth (basic)
Data elements: Date of birthMedical information
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney GeneralReported the event to the U.S. Department of Health & Human Services

During the incident: Engaged a leading cybersecurity and forensic firm to investigate the incident, to contain the threat, and to restore system functionality
Reported the event to the U.S. Department of Health & Human Services
Established a toll-free call center to answer questions about the incident and to address related concerns
Provided access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Provided proactive fraud assistance through Cyberscout
Changes made: Improved its web server infrastructure
Implemented enhanced safeguards to reduce the risk of future incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(69 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGJul 21 · first

Nebraska State AGJul 21 · first

Vermont State AGJul 21 · first

New Hampshire State AGJul 21 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/upper-dublin-family-dentistry-20250721.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 21, 2025
Raw hash: 29f76c00773d9c1b0ea70f17397d092929545e6ba237c23924dafe5bd80610fe

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityUpper Dublin Family Dentistry

Victim entityUpper Dublin Family Dentistry

Incidentdiscovered May 13, 2025

Stated responseEngaged a leading cybersecurity and forensic firm to investigate the incident, to contain the threat, and to restore system functionality

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov