MalwareHealthcareHealthcareRansomwareData EncryptedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PHIMediumContained

Maternal & Family Health Services

bd_6d4cfb317daf08cd · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 4, 2022

Filed

Jan 17, 2023

To disclose

41 weeks

Affected

64state residents only

Linked

4 filings

Confidence

66%

Full breach record for Maternal & Family Health Services →

Maternal & Family Health Services, Inc. (MFHS) notified the New Hampshire Attorney General of a ransomware incident affecting 64 NH residents. Unauthorized access occurred between August 21, 2021, and April 4, 2022. Exposed data included names, SSNs, driver's licenses, financial account info, and medical/health insurance data. MFHS engaged forensic experts, notified law enforcement, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 226 days

discovery → filing · 41 weeks / 288 days

Aug 21, 2021

Begins

Apr 4, 2022

Discovered

Jan 17, 2023

Filed

vs. sector median

+29 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_4b5591fe1864b5b72023-01-10 · +7dVerified by operator
Delaware State AGbd_04525bd194c7c5a32023-01-03 · +14dCandidate
Maine State AGbd_cf0932fca26647762023-07-29 · +193dVerified

Name: FisherBroyles LLP
norm: fisherbroyles

Name: Maternal & Family Health Services
norm: maternal family health
Industry: Healthcarellm

Discovered: Apr 4, 2022
Breach occurred: Aug 21, 2021 – Apr 4, 2022
Undetected for: 226 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 3, 2023
Affected individuals: 64state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: reported the Incident to law enforcement

During the incident: Reported the Incident to law enforcement
Worked with cybersecurity counsel and forensic experts to investigate
Engaged a national cybersecurity firm to assist in assessing the scope of the incident
Took steps to mitigate the potential impact to our community
Offered complimentary identity theft and credit monitoring services for twelve (12) months
Changes made: Strengthening its security posture
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 41 weeks(288 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Delaware State AGJan 3 · first

Montana State AG+7d

New Hampshire State AG+14d · this page

Maine State AG+207d

Pattern: first filing Jan 3 (DE), last Jul 29 (ME) — a 207-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/maternal-family-health-services-20230117.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 17, 2023
Raw hash: fbd377c91723b56c37f7fb6e4683170a31905f784ba072985b7616749840dd3b

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityFisherBroyles LLP

Victim entityMaternal & Family Health Services

Incidentdiscovered Apr 4, 2022

Stated responseReported the Incident to law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov