HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedIDENTITY_GOVERNMENTIDENTITY_BASICCriticalContained
NextGen Healthcare, Inc.
bd_67403124c4531ddc · schema v1 · pii pii-v1
Full breach record for NextGen Healthcare, Inc. →NextGen Healthcare, Inc. reported a data breach occurring between March 29, 2023, and April 14, 2023, discovered on April 24, 2023. Unauthorized access to a database occurred via stolen client credentials obtained from unrelated incidents. The breach affected approximately 1,049,375 individuals, including 3,913 Maine residents. Compromised data included names and Social Security Numbers. NextGen provided 24 months of identity theft protection through Experian.
Maine clockDiscovered Apr 24, 2023 → Filed with AG May 5, 202311d ✓ ME AG ≤30d11 days discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
This filing is one of 8 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (7) · sorted by filing gap
- bd_5e938c6c211b169dNew Hampshire State AGfiled 2023-05-05Verified
- bd_f1137d837aea9e06California State AGfiled 2023-05-05Verified
- bd_7a7f5ee7fb7c68c8Oregon State AGfiled 2023-05-04(1d gap)Verified
- bd_7e4510c6361c4a71Washington State AGfiled 2023-05-03(2d gap)Verified
Show 3 more filings ↓Show fewer ↑up to 8d gap
- bd_03d4dffa3da1766cMontana State AGfiled 2023-04-28(7d gap)Candidate
- bd_1c6d555d72e68d6fDelaware State AGfiled 2023-04-28(7d gap)Verified
- bd_33ab8daf3c08c256Vermont State AGfiled 2023-04-27(8d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/cb1d4654-0ce0-4e59-9eec-24391249e2a8.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 5, 2023
- Raw hash
- ce66eb9a5e92c7632fe85577591cc4b7d2a66bcf8b8c8a9fe89efab25ffb61e9
Reporting entity
- Name
- NextGen Healthcare, Inc.norm: nextgen healthcare
Victim entity
- Name
- NextGen Healthcare, Inc.norm: nextgen healthcare
Incident
- Discovered
- Apr 24, 2023
- Materiality determined
- —
- Notification sent
- Apr 28, 2023
- Affected individuals
- 1,049,375
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- ExternalFinancial
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 11 days(11 days from discovery to filing)
- Compliance flags
- ME AG ≤30d · 11d
- Discovery-date grounding
- AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Apr 24, 2023→ Filed with AG: May 5, 202311d 30 days ME AG ≤30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.