HackingHealthcareHealthcareSupply Chain (3P Vendor)Employee Data InvolvedIdentity (basic)Government IDFinancial accountEmploymentMediumContained

Inn at Deerfield, Inc.

bd_6e16f72f7cb5893b · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 19, 2020

Filed

Jul 2, 2020

To disclose

6 weeks

Affected

372state residents only

Confidence

66%

Full breach record for Inn at Deerfield, Inc. →

Inn at Deerfield, Inc., a nonprofit dementia care home, reported that an unverified third-party consultant gained remote access to one computer containing payroll records for 372 New Hampshire residents on May 19, 2020. The access lasted approximately 20 minutes. Affected data included names, addresses, Social Security numbers, dates of birth, and direct deposit banking information. The organization wiped the affected computer, notified law enforcement, and provided 12 months of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 weeks / 44 days

May 19, 2020

Begins

May 19, 2020

Discovered

Jul 2, 2020

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed372 affectedView incident

Name: Inn at Deerfield, Inc.
norm: inn at deerfield
Domain: innatdeerfield.org

Name: Inn at Deerfield, Inc.
norm: inn at deerfield
Domain: innatdeerfield.org
Industry: Healthcarellm

Discovered: May 19, 2020
Breach occurred: May 19, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 3, 2020
Affected individuals: 372state-resident count only
Data types: Identity (basic)Government IDFinancial accountEmployment
Attack vector: Third-Party / Supply Chain
Threat actor: Partner
Regulator citations: Reported to the Office of the Attorney General, Department of Justice, New Hampshire
Third party: via Unknown third-party software consultant
Initial access: trusted_relationship

During the incident: Retained an information technology provider to wipe clean the one computer the third-party accessed
Examined the Inn's other computer systems
Notified law enforcement authorities
Mailed notices to affected individuals
Contracted to offer credit monitoring services to affected individuals for 12 months
Changes made: Taken steps to prevent similar incidents from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(44 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/inn-at-deerfield-20200702.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 2, 2020
Raw hash: 75680bcc3cd3cf80a4256d0986c15780802b9fdd63bc80b5026969143384aa15

Reporting entityInn at Deerfield, Inc.

Victim entityInn at Deerfield, Inc.

Incidentdiscovered May 19, 2020

Stated responseRetained an information technology provider to wipe clean the one computer the third-party accessed

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov