HackingHealthcareHealthcareCustomer Data InvolvedGovernment IDHighContained

THE UNIVERSITY OF CHICAGO MEDICAL CENTER

bd_6f1b677e1645896e · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 28, 2024

Filed

May 24, 2024

To disclose

8 weeks

Affected · nationwide

10,3328 in this filing

Linked

5 filings

Confidence

50%

Full breach record for THE UNIVERSITY OF CHICAGO MEDICAL CENTER →3 incidents on file

The University of Chicago Medical Center, a healthcare organization, reported an external system breach that occurred between January 4, 2024, and January 30, 2024. The breach was discovered on March 28, 2024, and affected 8 Maine residents. The compromised information includes names and Social Security Numbers. Affected individuals were notified on May 24, 2024, and offered 24 months of complimentary credit monitoring and identity protection services through Experian.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Mar 28, 2024 → Filed with AG May 24, 202457d ⏱ ME AG >30d8 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 84 days

discovery → filing · 8 weeks / 57 days

Jan 4, 2024

Begins

Mar 28, 2024

Discovered

May 24, 2024

Filed

vs. sector median

1 wks faster

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_487a51f21555d0882024-05-24Verified
HHS OCRbd_579dc4b435838e452024-05-24Verified
Indiana State AGbd_95695ad34ba421f92024-05-24Verified
Illinois State AGbd_723bf1e39f74089b2024-05-01 · +23dVerified by operator

Name: THE UNIVERSITY OF CHICAGO MEDICAL CENTER
norm: the university of chicago medical center
Domain: uchicagomedicine.org

Name: THE UNIVERSITY OF CHICAGO MEDICAL CENTER
norm: the university of chicago medical center
Domain: uchicagomedicine.org
Industry: Healthcarellm

Discovered: Mar 28, 2024
Breach occurred: Jan 4, 2024 – Jan 30, 2024
Undetected for: 84 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 24, 2024
Affected individuals: 10,332state + nationwide
Data types: Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
Threat actor: External

Changes made: UCMC is offering complimentary credit monitoring and identity protection services through Experian to certain affected individuals for 24 months.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: ME AG >30d · 57d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Mar 28, 2024
→ Filed with AG: May 24, 2024
57d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Mar 28, 2024 → Filed with AG: May 24, 2024	57d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Illinois State AGMay 1 · first

Massachusetts State AG+23d

HHS OCR+23d

Indiana State AG+23d

Maine State AG+23d · this page

Pattern: first filing May 1 (IL), last May 24 (ME) — a 23-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/4de2bac3-a7ba-4ce0-a67e-cfc87d4178d3.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 24, 2024
Raw hash: 0c04d3bffe47d1b6b976e68f3770a9edb6e54fcca17ed658d0f7c7b29cee8f73

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityTHE UNIVERSITY OF CHICAGO MEDICAL CENTER

Victim entityTHE UNIVERSITY OF CHICAGO MEDICAL CENTER

Incidentdiscovered Mar 28, 2024

Stated responseUCMC is offering complimentary credit monitoring and identity protection services through Experian to certain affected individuals for 24 months.

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov