HackingHealthcareHealthcareData ExfiltratedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountEmploymentMediumContained

YORK HOSPITAL

bd_678a73232f6b4dca · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Dec 23, 2016

To disclose

—

Affected

235state residents only

Confidence

66%

Full breach record for YORK HOSPITAL →4 incidents on file

York Hospital notified the NH Attorney General of a supplemental breach disclosure. On Feb 22, 2016, cybercriminals stole personal info (names, SSNs, addresses, W-2s) of employees. ~235 NH residents and ~1,211 Maine residents were affected. No patient data was compromised. Hospital engaged forensics, notified law enforcement, and offered credit protection.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 22, 2016

Begins

Dec 23, 2016

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed235 affectedView incident

Name: YORK HOSPITAL
norm: york hospital

Name: YORK HOSPITAL
norm: york hospital
Industry: Healthcarellm

Discovered: —
Breach occurred: Feb 22, 2016
Materiality determined: —
Notification sent: Feb 24, 2016
Affected individuals: 235state-resident count only
Data types: Identity (basic)Government IDFinancial accountEmployment
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Department of JusticeNotified Maine Attorney General

During the incident: Reported the theft to local law enforcement police
Continuing to work with the FBI investigation
Engaged private computer forensic experts to investigate the incident
Engaged legal counsel from the law firm of Verrill Dana
Agreed to pay for appropriate credit protection services such as a credit freeze, credit monitoring, credit fraud alerts, and provide advice on protecting against tax fraud
Continues to answer employee inquiries
Changes made: Engaged IT specialists and the law firm of Verrill Dana to develop and implement new safeguards in its information technology and information security systems
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/york-hospital-20161223.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 23, 2016
Raw hash: 42c6035a0b9430894597c7c75db655ec628363c6eeec9429a69d4e2e51ebcbaa

Reporting entityYORK HOSPITAL

Victim entityYORK HOSPITAL

IncidentUnauthorized Access

Stated responseReported the theft to local law enforcement police

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov