HackingHealthcareHealthcareStolen CredentialsTargetedIdentity (basic)Government IDPHIHealth (basic)MediumContained

True Health New Mexico

bd_6baf9783bacf4410 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 5, 2021

Filed

Nov 15, 2021

To disclose

6 weeks

Affected

30state residents only

Linked

3 filings

Confidence

64%

Full breach record for True Health New Mexico →

True Health New Mexico, Inc. notified members of a data security incident in early October 2021 where an unauthorized third party gained access to IT systems. Affected data included PHI, SSNs, names, and DOBs. The company engaged forensic investigators, secured systems, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 4 days

discovery → filing · 6 weeks / 41 days

Oct 1, 2021

Begins

Oct 5, 2021

Discovered

Nov 15, 2021

Filed

vs. sector median

5 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_c6b5abb85baf5aa32021-11-15Verified
HHS OCRbd_99f9dd3962b0fb182021-11-17 · +2dVerified

Name: True Health New Mexico
norm: true health new mexico

Name: True Health New Mexico
norm: true health new mexico
Industry: Healthcarellm

Discovered: Oct 5, 2021
Breach occurred: Oct 1, 2021 – Oct 5, 2021
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 15, 2021
Affected individuals: 30state-resident count only
Data types: Identity (basic)Government IDPHIHealth (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Notified appropriate governmental authorities
Initial access: valid_credentials

During the incident: Secured and contained impacted systems
Retained external cybersecurity professionals to assist in an investigation
Shut down certain systems where necessary
Supplemented existing security monitoring, scanning, and protective measures
Notified appropriate governmental authorities
Offering a complementary 24-month membership for IDX’s credit monitoring services
Changes made: Supplemented existing security monitoring, scanning, and protective measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(41 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGNov 15 · first

Montana State AGNov 15 · first · this page

HHS OCR+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-84.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 15, 2021
Raw hash: b5ca9c7b8c59f73600200ea5700de4c251ae1211b764341f109a5b431d403bf6

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityTrue Health New Mexico

Victim entityTrue Health New Mexico

Incidentdiscovered Oct 5, 2021

Stated responseSecured and contained impacted systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov