HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountCredentialsHealth (basic)PHIMinorMediumContained

Heartland Health Center

bd_647209df288b0fc3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 4, 2025

Filed

Oct 21, 2025

To disclose

37 weeks

Affected

5state residents only

Linked

7 records

Confidence

66%

Full breach record for Heartland Health Center →3 incidents on file

Heartland Health Center notified Montana residents of unauthorized network access discovered on Feb 4, 2025. Incident exposed PII including SSNs, DOBs, driver's licenses, financial account numbers, and PHI. Notices sent Oct 17, 2025, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d37 weeks discovery → filing

Incident timeline

discovery → filing · 37 weeks / 259 days

Feb 4, 2025

Discovered

Oct 21, 2025

Filed

vs. sector median

+28 wks slower

This filing is one of 7 records about the same incident.View merged incident

A leak claim by medusa about this victim was first seen 238 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitemedusabd_1ee456f0ab511bcc2025-02-24 · +238dVerified by operator

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_b8d6da33aca4814b2025-10-21Verified
Vermont State AGbd_fba45e2f4449c4ea2025-10-21Verified by operator
HHS OCRbd_5f6155b7de4c7d602025-10-17 · +4dVerified
Nebraska State AGbd_a5f51d90e496110e2025-10-17 · +4dVerified by operator

Show 1 more filing ↓up to 4d gap

Indiana State AGbd_b8679ec8856a290a2025-10-17 · +4dVerified by operator

Name: Heartland Health Center
norm: heartland health center
Domain: heartlandhealthcenter.org

Name: Heartland Health Center
norm: heartland health center
Domain: heartlandhealthcenter.org
Industry: Healthcarellm

Discovered: Feb 4, 2025
Materiality determined: —
Notification sent: Oct 17, 2025
Affected individuals: 5state-resident count only
Data types: Identity (basic)Government IDFinancial accountCredentialsHealth (basic)PHIMinor
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Engaged forensic consultants to investigate the root of the incident
Secured its systems
Initiated an investigation into the unauthorized access
Provided access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Provided proactive fraud assistance
Changes made: Continuously upgrading security measures to carefully safeguard against similar incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 37 weeks(259 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

HHS OCROct 17 · first

Nebraska State AGOct 17 · first

Indiana State AGOct 17 · first

Massachusetts State AG+4d

Vermont State AG+4d

Montana State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2025/10/Consumer-notification-letter-29.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 21, 2025
Raw hash: 3f0ccd2bd3b4a180edc8929b8868efc1b5c454501ec3e39e91e809930db8910a

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityHeartland Health Center

Victim entityHeartland Health Center

Incidentdiscovered Feb 4, 2025

Stated responseEngaged forensic consultants to investigate the root of the incident

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancedojmt.gov